DEVELOPMENT OF SAFETY STANDARDS FOR CUBESAT PROPULSION SYSTEMS

Transcription

1 DEVELOPMENT OF SAFETY STANDARDS FOR CUBESAT PROPULSION SYSTEMS A Thesis presented to the Faculty of California Polytechnic State University San Luis Obispo In Partial Fulfillment of the Requirements for the Degree Master of Science in Aerospace Engineering by Liam J. Cheney January 2014

2 2014 Liam J. Cheney ALL RIGHTS RESERVED ii

3 COMMITTEE MEMBERSHIP TITLE: Development of Safety Standards for CubeSat Propulsion Systems AUTHOR: Liam J. Cheney DATE SUBMITTED: January 2014 COMMITTEE CHAIR: Jordi Puig-Suari, PhD Professor of Aerospace Engineering COMMITTEE MEMBER: Kira Abercromby, PhD Assistant Professor of Aerospace Engineering COMMITTEE MEMBER: Roland Coelho Research Associate, Aerospace Engineering Department COMMITTEE MEMBER: Gerald Shaw, PhD Senior Research Engineer, SRI International COMMITTEE MEMBER: Daniel Wait Engineer, Tyvak Nano-Satellite Systems LLC iii

4 Disclaimer At this time, any standards or requirements that are proposed in this document are in draft form and should not be used for mission planning purposes without consultation with the launch provider or the auxiliary payload integrator. The author hopes that the reader will find the discussions contained in this document useful as he or she assess the risks associated with their particular mission. For updates regarding the release of standards and requirements related to the CubeSat Design Specification (CDS), visit the Cal Poly CubeSat Program s website, iv

5 ABSTRACT Development of Safety Standards For CubeSat Propulsion Systems Liam J. Cheney The CubeSat community has begun to develop and implement propulsion systems. This movement represents a new capability which may satisfy mission needs such as orbital and constellation maintenance, formation flight, de-orbit, and even interplanetary travel. With the freedom and capability granted by propulsion systems, CubeSat providers must accept new responsibilities in proportion to the potential hazards that propulsion systems may present. The Cal Poly CubeSat program publishes and maintains the CubeSat Design Specification (CDS). They wish to help the CubeSat community to safety and responsibly expand its capabilities to include propulsive designs. For this reason, the author embarked on the task of developing a draft of safety standards CubeSat propulsion systems. Wherever possible, the standards are based on existing documents. The author provides an overview of certain concepts in systems safety with respect to the classification of hazards, determination of required fault tolerances, and the use of inhibits to satisfy fault tolerance requirements. The author discusses hazards that could exist during ground operations and through launch with respect to hazardous materials and pressure systems. Most of the standards related to Range Safety are drawn from AFSPCMAN Having reviewed a range of hypothetical propulsion system architectures with an engineer from Range Safety at Vandenberg Air Force Base, the author compiled a case study. The author discusses many aspects of orbital safety. The author discusses the risk of collision with the host vehicle and with third party satellites along with the trackability of CubeSats using propulsion systems. Some recommendations are given for working with the Joint Functional Component Command for Space (JFCC SPACE), thanks to the input of two engineers who work with the Joint Space Operations Center (JSpOC). Command Security is discussed as an important aspect of a mission which implements a propulsion system. The author also discusses End-of-Life procedures such as safing and de-orbit operations. The orbital safety standards are intended to promote good citizenship. The author steps through each proposed standard and offers justification. The author is confident that these standards will set the stage for a dialogue in the CubeSat community which will lead to the formulation of a reasonable and comprehensive set of standards. The author hopes that the discussions given throughout this document will help CubeSat developers to visualize the path to flight readiness so that they can get started on the right foot. Keywords: CubeSat, propulsion, micropropulsion, safety, Range Safety, qualification, requirements, Cal Poly, CubeSat Design Specification, pressure vessels, orbital safety, nanosatellite, small satellite, P-POD. v

6 ACKNOWLEDGMENTS The author wishes to acknowledge many people who have supported him throughout this project. Many have lent their time and resources to make this project possible. The author especially wishes to thank the Cal Poly Aerospace Engineering Department in San Luis Obispo. Professor Dr. Jordi Puig-Suari oversees the Cal Poly CubeSat Program. He and Roland Coelho had a major role in leading the author to this particular thesis topic and have supported him throughout the project. Both serve on his Thesis Committee. Professor Dr. Kira Abercromby has played a major role in building the author s skills throughout his academic career, which has prepared him to tackle this topic. She also serves on the author s Thesis Committee. The author also wishes to thank Daniel Wait of Tyvak Nano-Satellite Systems, LLC, for his support as a Thesis Committee member. Thanks to Simon Lee and Scott Williams of SRI International, the author has enjoyed the opportunity to work with Dr. Gerald Gerry Shaw and Dr. Mark Tinkle in the San Luis Obispo SRI office. The experience has had a very positive impact on the outcome of this project. Gerry Shaw brings his own expertise to the table in serving serving on the author s Thesis Committee. Gerry Shaw introduced the author to Kevin Case, a Range Safety Engineer at Vandenberg Air Force Base, who devoted much effort to educate the author of the nuances of the Range Safety documents. He met with the author to discuss the case study which adds much value to the end product. Gerry Shaw also introduced the author to Edward Quinonez of Booz Allen Hamilton and Richard C. Diamantopoulos of Scitor, who both support JFCC SPACE. Their perspective helped the author to understand how CubeSat operators should interact with the Joint Space Operations Center (JSpOC), and they identified ways that CubeSat providers can aid the JSpOC in improving the level of safety for orbital operations. The author wishes to express an immense gratitude to his family, whose impact cannot be underestimated. His family, together with the Newman Catholic Community, especially through the ministries of Fr. John Ulrich, S.M., Fr. Kevin Duggan, S.M., and Linda Garcia, has provided endless love and support to the author, supplying the motivation needed to accomplish this task while growing in faith and maturity. The author is also grateful for his housemates at Casa Romero for the brotherhood they have shared, which has helped to build him up during these years. Of course, all gratitude is ultimately due to God the Father, the Son, and the Holy Spirit, who loves to make us instruments in His great works of creation, redemption, and inspiration, and through whom all things are possible. vi

7 TABLE OF CONTENTS Page LIST OF TABLES... xviii LIST OF FIGURES... xxi CHAPTER I. INTRODUCTION... 1 Background... 3 The CubeSat Class of Satellites... 3 The Need for a Safety Standard... 6 Responsibility of the Cal Poly CubeSat Program... 6 Overview of Hazards Associated with Self-Propelled CubeSats... 7 Potential Hazards to Personnel... 8 Potential Hazards to the Primary Mission... 9 Potential Hazards to Third-Party Spacecraft Propulsion Systems Available or Under Development Cold Gas Thrusters (Physical Energy) Resistojet (Physical, Electric) Monopropellant Thrusters (Chemical Energy) Electrospray (Electric) vii

8 Pulsed Plasma Thrusters, PPT (Electric) MEMS Solid Rocket Motor (Chemical Energy, MEMS) Ion Thrusters (Electric) Vacuum Arc Thrusters (Electric) Objective Scope Disclaimer About this Document II. METHODOLOGY Flow from Existing Standards CubeSat Standards Committee s Desires Swim-Lanes Positive Control Range Safety vs. Orbital Safety Implementation Analysis III. EXISTING STANDARDS CubeSat Design Specification (CDS) Future revisions of the CDS AFSPCMAN : Range Safety User Requirements viii

9 AFI : Space Safety and Mishap Prevention Program AFSPCI : Satellite Operations Satellite Disposal FCC Policies NASA STD : Process for Limiting Orbital Debris IV. CONCEPTS IN SYSTEM SAFETY Proper Response to Hazards Hazard Severity and Fault Tolerance Non-Credible Hazards Inhibits V. RANGE SAFETY Hazardous Material Material Compatibility Toxicity Transportation Containment of Hazardous Fluids Spills and Vapor Monitoring Pressure Systems Pressure System Fault Tolerance Hazardous Pressure System Components Pressure Vessel Verification ix

10 Failure Mode Leaking Hazard Verification Approaches Metallic Pressure Vessels Verification Approach A Path Metallic Pressure Vessels Verification Approach A Path Sealed Container Non-Hazardous LBB Recertification and Refurbishment Implementation Structural Failure Not Considered Single Point of Failure Dual Seat Valves Poppet and Cap Fill/Drain Interfaces Omitted Sections from AFSPCMAN VI. RANGE SAFETY CASE STUDIES Summary of Cases Case 1: Monopropellant, Hydrazine Hazard overview Inhibits Fill / Drain Connection x

11 Propellant Leakage through the Nozzle Premature Firing Pressure Vessel Requirements Case 2: Monopropellant, Hydrogen Peroxide Hazard Overview Inhibits Fill / Drain Connection Propellant Leakage through the Nozzle Premature Firing Pressure Vessel Requirements Case 3: Monopropellant, AF-M315E (Aqueous HAN Solution) Hazard Overview Inhibits Fill / Drain Connection Propellant Leakage through the Nozzle Premature Firing Pressure Vessel Requirements Case 4: Cold Gas, Nitrogen Hazard Overview Inhibits xi

12 High Pressure Jet through Fill / Drain Port High Pressure Jet through Nozzle Pressure Vessel Requirements Case 5: Resistojet, R-134a Hazards Overview Inhibits Propellant Leak through Fill / Drain Port Propellant Leak through Nozzle Premature Heating of the Propellant and Firing Pressure Vessel Requirements Case 6: Electrospray, Ionic fluid Overview of Hazards Inhibits Propellant Containment Case 7: Electrospray, Gallium Hazards Overview Inhibits Fill / Drain Connection Leakage through the Thruster Premature Electric Discharge Propellant Containment xii

13 Case 8: Ion Thruster, Xenon Hazards Overview Inhibits High Pressure Jet through Fill Port High Pressure Jet through Thruster Premature Electric Discharge Pressure Vessel Requirements Case 9: Pulsed Plasma Thruster, Teflon Hazards Overview Inhibits VII. ORBITAL SAFETY Collision with the Host Vehicle Analysis Assumptions Model Parameters Lamberts Method, Universal Variables Model Validation Results Linear Trend for Close-Proximity Operations Independencies xiii

14 Examples Collision with Third Party Satellites Maneuver Envelope Study Impulsive Maneuvers Continuous Burn Maneuvers Control Modes Continuous Burn Analysis Results Pointing Error Analysis Results Trackability Low V Maneuvers Methods of Improving Trackability Communication with JFCC SPACE Radio Reflectors and RFID Command Security Contributing Factors Capability-Related Factors Security-Related Factors Potential Methods of Mitigation xiv

15 Command encryption Ground Station Cyber Security Personnel Security Situational Awareness End-of-Life: Passivation Potential Methods of Passivation Propellant Venting Chemical Inhibition End-of-Life: De-orbit and Re-entry Orbital Lifetime Assessment Tank Material and Orbital Debris Assessment Report Non-Federal Spacecraft Federal CubeSats VIII. PROPOSED STANDARDS Fault Tolerance and Inhibits Propulsion System General Requirements Range Safety Standards Hazardous Materials Pressure Systems xv

16 Propellant and Pressure System Design Requirements Pressure Vessel and Propellant Reservoir Verification Paths Pressure System Components Systems Not Currently Supported Orbital Safety Standards Command Security Close Proximity Operations with Host Vehicle Trackability End-of-Life (EOL) Safing, Passivation, and Disposal Re-entry Survivability IX. CONCLUSION Next Steps Publishing the Standards Notify Launch Providers of Close Proximity Analysis Recommendations for Research Develop RFID Devices Continue Close Proximity Analysis Command Security Unified Orbital Safety Authority xvi

17 LIST OF REFERENCES APPENDIX A. Nomenclature APPENDIX B. Draft of Standards xvii

18 LIST OF TABLES Page Table 1: Potentially restrictive requirements from the CDS (CubeSat Design Specification Rev. 12, 2009) Table 2: Other applicable requirements from the CDS (CubeSat Design Specification Rev. 12, 2009) Table 3: Definition and implications of hazard severity Table 4: Applicability of AFSPCMAN Vol. 3 Ch. 12 requirements for pressure vessels and sealed containers (AFSPCMAN Vol. 3, 2004) Table 5: Verification requirements for metallic pressure vessels following Verification Approach A Path 1, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004) Table 6: Verification requirements for metallic pressure vessels following Verification Approach A Path 2, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004) Table 7: Verification requirements for Sealed Containers following Verification Approach A Path 1, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004) Table 8: Applicability of AFSPCMAN Vol. 3 requirements for some specific pressure system types (system level) (AFSPCMAN Vol. 3, 2004) Table 9: Summary of Hypothetical Cases Table 10: Monopropellant Hydrazine Case, Hypothetical System Parameters Table 11: Monopropellant Hydrazine Case, Hypothetical Hazards xviii

19 Table 12: Hydrazine Monopropellant Case, Hypothetical Inhibits Table 13: Monopropellant Hydrogen Peroxide Case, Hypothetical System Parameters Table 14: Monopropellant Hydrogen Peroxide Case, Hypothetical Hazards Table 15: Monopropellant Hydrogen Peroxide Case, Hypothetical Inhibits Table 16: Monopropellant AF-315E Case, Hypothetical System Parameters Table 17: Monopropellant AF-315E Case, Hypothetical Hazards Table 18: Monopropellant AF-315E Case, Hypothetical Inhibits Table 19: Cold Gas Nitrogen Case, Hypothetical System Parameters Table 20: Cold Gas Nitrogen Case, Hypothetical Hazards Table 21: Cold Gas Nitrogen Case, Hypothetical Inhibits Table 22: Resistojet R-134a Case, Hypothetical System Parameters Table 23: Resistojet R-134a Case, Hypothetical Hazards Table 24: Resistojet R-134a Case, Hypothetical Inhibits Table 25: Electrospray Ionic Fluid Case, Hypothetical System Parameters Table 26: Electrospray Ionic Fluid Case, Hypothetical Hazards Table 27: Electrospray Ionic Fluid Case, Hypothetical Inhibits Table 28: Gallium Ionic Fluid Case, Hypothetical System Parameters Table 29: Gallium Ionic Fluid Case, Hypothetical Hazards Table 30: Gallium Ionic Fluid Case, Hypothetical Inhibits Table 31: Ion Thruster Xenon Case, Hypothetical System Parameters Table 32: Ion Thruster Xenon Case, Hypothetical Hazards Table 33: Ion Thruster Xenon Case, Hypothetical Inhibits Table 34: PPT Teflon Case, Hypothetical System Parameters xix

20 Table 35: PPT Teflon Case, Hypothetical Hazards Table 36: PPT Teflon Case, Hypothetical Inhibits Table 37: Model parameters for each run xx

21 LIST OF FIGURES Page Figure 1: A 1U CubeSat Satellite prior to integration to the P-POD (CubeSat Program Pictures, 2009) Figure 2: A view of the 3U envelope given in the CDS Rev. 12 (CubeSat Design Specification Rev. 12, 2009) Figure 3: Left: a closed P-POD. Right: an empty P-POD, looking through the open door, with the spring decompressed (door not shown) (CubeSat Design Specification Rev. 12, 2009) Figure 4: Overview of hazards Figure 5: Example inhibit diagram for critically hazardous propellant Figure 6: Pressure vessel verification approaches, taken from AFSPCMAN Vol. 3 Figure 12.1 (AFSPCMAN Vol. 3, 2004) Figure 7: Monopropellant Hydrazine Case, Hypothetical System Schematic Figure 8: Monopropellant Hydrogen Peroxide Case, Hypothetical System Schematic Figure 9: Monopropellant AF-315E Case, Hypothetical System Schematic Figure 10: Cold Gas Nitrogen Case, Hypothetical System Schematic Figure 11: Resistojet R-134a Case, Hypothetical System Schematic Figure 12: Gallium Ionic Fluid Case, Hypothetical System Schematic Figure 13: Ion Thruster Xenon Case, Hypothetical System Schematic Figure 14: The short term velocity required for a single-pass intercept with the host vehicle increases approximately by the product of the tangential separation xxi

22 velocity and the number of orbits passed. Model Parameters: 600 km circular orbit after, separation velocity tangential +1 m/s Figure 15: This plot of the relative position of a CubeSat with respect to the primary satellite illustrates a hypothetical mishap in which an erroneous burn causes collision with the primary. The origin is fixed at the location of the primary satellite. In the blue trajectory, the launch vehicle drifts until CubeSat deployment. In the green trajectory, the CubeSat drifts until a burn occurs. The red trajectory shows a collision with the primary satellite Figure 16: The long-term analysis spanning 8000 orbits shows the repeating pattern. Model Parameters: 600 km circular orbit, separation velocity tangential 1 m/s Figure 17: The long-term analysis spanning 3000 orbits shows the effects of the de-orbit condition which nullifies some of the points that would otherwise serve as optima. Model Parameters: 600 km circular orbit, separation velocity tangential - 1 m/s Figure 18: The optimum TOF for this test case is correctly rejected by the model because the respective trajectory would have intersected the earth. Model Parameters: 600 km circular orbit after 2060 orbits of delay time, separation velocity tangential - 1 m/s Figure 19: The long-term trend shown here for a positive tangential separation velocity mirrors the trend for a negative tangential separation velocity. Model Parameters: 600 km circular orbit, separation velocity tangential + 1 m/s (blue), - 1 m/s (red) xxii

23 Figure 20: In the near term, the separation velocity makes very little difference. Model Parameters: 600 km circular orbit, separation velocity tangential 1 and 2 m/s. The slope is normalized in comparison with the separation velocity Figure 21: For these ranges, slope is nearly independent of separation velocity, direction, inclination, and true anomaly at separation Figure 22: For these ranges the trend stays above ~90% of the predicted trend. Anywhere below can be considered a safe zone Figure 23: Separation velocity 89 degrees offset from the tangential velocity, in-plane Figure 24: Separation velocity 89 degrees offset from the tangential velocity, out-ofplane Figure 25: In this example, the CubeSat performance profile would allow the propulsion system to be safely armed four orbital periods after deployment Figure 26: In this example, the CubeSat performance profile would not require the operator to wait to enable the propulsion system beyond a reasonable timeframe necessary to reduce thruster plume impingement on the host vehicle Figure 27: Velocity change after an impulsive burn Figure 28: Visualization of a single-burn impulsive maneuver Figure 29: Apogee change after an impulsive burn Figure 30: Thrust direction control modes Figure 31: Control Mode 1: The thrust vector tracks the velocity vector throughout the burn. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn xxiii

24 Figure 32: Control Mode 2: The thrust vector is inertial fixed approximately pointing toward the average velocity direction. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn Figure 33: Control Mode 3: The thrust vector is inertial fixed toward at the initial velocity direction. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn Figure 34: Maximum altitude range for Control Mode Figure 35: Maximum altitude range for Control Mode Figure 36: Maximum altitude range for Control Mode Figure 37: Boundary for safe maneuvers with respect to the ISS for a range of V up to 0.1 km/s (100 m/s) Figure 38: Visualization of a trajectory with pointing error Figure 39: Feasible altitude error due to pointing error xxiv

25 I. INTRODUCTION The goal of this research project is to enable CubeSat developers to safety and responsibly incorporate propulsion systems into their designs. Through the development of safety standards, the Cal Poly CubeSat program wishes to establish norms by which the CubeSat community can build a reputation for safety in ground operations, orbital operations, and disposal of propulsive designs. This document serves two primary purposes. First, the document contains rationale behind each proposed safety standard. The author intends to submit these proposed standards to the CubeSat Standards Committee. Secondly, this document offers guidance to the CubeSat developer who wishes to achieve propulsive capabilities but cannot yet visualize the path to launch readiness. The CubeSat developer is encouraged to consider the validity of the assumptions that the author makes when assessing the level of safety of their particular mission. The author wishes to help illuminating the path to qualification and identify potential consequences of certain decision. The CubeSat developer can then better navigate their trade space and plan a realistic mission timeline. Throughout this study, the CubeSat program has engaged the expertise of authorities such as Range Safety and the Joint Space Operations Center (JSpOC). In fact, the CubeSat program, with support from its subcontractor SRI International, successfully obtained approval to fly its first mission with a propulsive CubeSat on GEMSat which launched on December 5th (Pacific Time), The GRACE and ULTRASat missions, which are expected to launch in 2014 and 2015, also include self-propelled CubeSats on their manifest. Work is underway to achieve an acceptable level of safety for these missions. The author, while working for SRI International, has interacted with the CubeSat providers and with Range Safety to help address the safety concerns for the propulsive CubeSats that are manifested on the GRACE and ULTRASat missions. The author hopes that the CubeSat community will benefit from the lessons learned during these campaigns. 1

26 The author began working with the CubeSat Program at Cal Poly in April, When the author began considering the blended M.S. program with the Cal Poly Aerospace Engineering Department, he scheduled a meeting with Roland Coelho to discuss thesis projects which could benefit the CubeSat Community. With an interest in propulsion, the discussion quickly led to the possibility of designing a micropropulsion system for CubeSat applications. After some research and planning, the author met with Professor Dr. Jordi Puig-Suari, who oversees the CubeSat Program at Cal Poly. After the author had presented the idea, Dr. Puig-Suari offered some very meaningful perspective. Dr. Puig-Suari has observed that many organizations have already begun work on micropropulsion systems. However, with many organizations designing propulsion systems, the community needed someone to investigate the related hazards so that those systems could eventually take flight. The CubeSat program at Cal Poly plays a unique role in the CubeSat industry. The program manufactures the Poly Picosatellite Orbital Deployer (P-POD), the original CubeSat deployment mechanism, and it organizes many launch opportunities for CubeSats. Cal Poly also publishes and maintains the CubeSat Design Specification (CDS). This standard is used throughout the industry to enable CubeSat developers to design their satellites with confidence that they will meet compatibility requirements for a flight-proven deployment mechanism. Suppliers who sell CubeSat parts and subsystems design to that specification. For example, many propulsion systems are designed to take one third of the volume (1U) of a 3U-sized CubeSat. In their stowed configuration, all CubeSat components are designed to fit within the envelope dictated by the dimensions of the P-POD. Cal Poly, which remains dedicated to the proliferation of CubeSats, is uniquely capable of addressing concerns that affect the entire CubeSat community. For this reason, Cal Poly has used the author s Master s Thesis research to explore the hazards associated with micropropulsion systems. Cal Poly currently supports CubeSat propulsion systems that wish to launch in the P-POD on a case-by-case basis and plans to eventually release official safety 2

27 standards, to be included with current requirements published in the CubeSat Design Specification (CDS). At that point, Cal Poly hopes to be able to support most propulsive CubeSat missions that comply with the standards. Background The CubeSat Class of Satellites The CubeSat was envisioned by Dr. Jordi Puig-Suari of Cal Poly and Dr. Bob Twiggs at Stanford University s Space Systems Development Laboratory (SSDL). According to the CubeSat Design Specification (CDS), they collaborated in order to reduce cost and development time, increase accessibility to space, and sustain frequent launches. This project has spawned a cohesive international community of CubeSat developers composed of organizations such as universities, high schools, and private firms (CubeSat Design Specification Rev. 12, 2009). Even government agencies now have a strong presence in the CubeSat developer community. The CDS generally defines a CubeSat in three basic sizes. A standard 1U CubeSat is roughly a 10 cm cube with approximately 1.33 kg of mass or less. A 2U CubeSat essentially fits the envelope of two 1U s. Finally, a 3U CubeSat fits the envelope of three 1U s with dimensions of approximately 10 cm x 10 cm x 30 cm and a mass of approximately 4 kg or less. 3

28 Figure 1: A 1U CubeSat Satellite prior to integration to the P-POD (CubeSat Program Pictures, 2009). Figure 2: A view of the 3U envelope given in the CDS Rev. 12 (CubeSat Design Specification Rev. 12, 2009). Cal Poly manufactures the Poly Picosatellite Orbital Deployer (P-POD). The P-POD is a reliable deployment mechanism which contains CubeSats during ground operations through launch, then separates the CubeSats from the host vehicle at a safe time during orbital operations. Briefly, the P-POD is a box-shaped metal container with four sets of rails inside. At integration, 4

29 CubeSats slide along the rails through the open end of the P-POD and compress the deployment spring which is attached to the closed end. Then the P-POD door closes and is secured by a Non- Explosive Actuator (NEA). The integrated P-POD can then be integrated to the host vehicle as a single unit. After launch, signals are sent to the NEA to release the P-POD door. The deployment spring then decompresses while pushing the CubeSats along the rails and out the open end of the P-POD. In this way, the CubeSats separate from the host vehicle with a relative velocity on the order of 1 to 2 m/s. Figure 3: Left: a closed P-POD. Right: an empty P-POD, looking through the open door, with the spring decompressed (door not shown) (CubeSat Design Specification Rev. 12, 2009). The design of the P-POD and its flight heritage allows CubeSats to safely fly as secondary payloads on many launches. This has helped the CubeSat program to realize its goal frequent low-cost access to space for CubeSat providers. As stated in the CDS, The primary responsibility of Cal Poly as the developer of the Poly Picosatellite Orbital Deployer (P-POD), is to ensure the safety of the CubeSat and protect the launch vehicle (LV), primary payload, and other CubeSats (CubeSat Design Specification Rev. 12, 2009). The research described in this document is centered on this theme of achieving a level of safety for CubeSats such that the 5

30 primary mission is not significantly impacted by the presence of the CubeSats onboard, even those CubeSats containing propulsion systems. The Need for a Safety Standard Currently, CubeSats only have access to Earth orbit as secondary payloads. The CubeSat community then relies on the good will of the primary payload providers and the launch vehicle providers. The CubeSat class of satellites and the P-POD now enjoy some heritage due to safe deployments on past missions, and the community benefits from the tremendous support of several launch providers. However, in the event of a mishap, the community may find it very difficult to recover its good reputation. It is the opinion of the author that the effects of any significant mishap would be felt throughout the CubeSat community. Each CubeSat developer must commit themselves to safety in order to build on the reputation the entire CubeSat industry. As the CubeSat community is united in its vulnerability, developers must unite and commit themselves to safety in ground operations, launch, deployment, orbital operations, and disposal. Over the years, the CubeSat community has displayed a commendable spirit of camaraderie and cohesion. In order to promote common ground it is advantageous to establish certain norms of behavior as a proper response to certain potential hazards. Responsibility of the Cal Poly CubeSat Program The Cal Poly CubeSat program occupies a unique role in the CubeSat community. As manufacturer of the P-POD and organizer of many launch opportunities, Cal Poly has a role in supporting many CubeSat missions. This has placed Cal Poly in an appropriate position to maintain the CubeSat Design Specification (CDS). Cal Poly continually works to identify potential modifications of the P-POD design and the CDS that could improve safety and accommodate ever more capable CubeSat designs. Cal Poly has identified a strong desire throughout the CubeSat community to fly propulsion systems. 6

31 As Cal Poly strives to support the CubeSat community in safely expanding its capabilities to include propulsive designs, it has begun to scrutinize the P-POD design and the CDS. This document outlines the research that the author has conducted in order to assess the range of hazards posed by different types of CubeSat propulsion systems. The document also describes proposed safety standards that may eventually be published together with requirements given in the CDS. Overview of Hazards Associated with Self-Propelled CubeSats The hazards that will be discussed throughout this document do not include hazards that would only affect the CubeSat mission. Mission assurance is not the focus of this project. While the author recognizes the value in developing effective CubeSat propulsion systems, that task is already underway through the work of many CubeSat developers. This document fills a different need by exploring the hazards that could affect the personnel, launch vehicle, primary payload, and third parties such as orbiting spacecraft. Figure 4 summarize the hazards that will be addressed. 7

32 Figure 4: Overview of hazards. Potential Hazards to Personnel A major goal of any safety program is personnel safety. Production and use of even the most advantageous technologies must be limited when its life cycle can cause illness, injury, or death. This does not exclude all technologies that may lead to casualty. Personnel hazards may be permitted when no alternative exists, but those hazards must be adequately contained. During ground operations, personnel safety is largely dependent on the toxicity of propellants and the potential for rapid release of physical or chemical energy. When hazardous materials are used, or when fluids are stored at high pressures, much scrutiny is needed to assess the level of safety of the related pressure systems and components such as pressure vessels. The hazards that may be posed to personnel during ground operations are discussed in Chapter V RANGE SAFETY. Most potential personnel hazards for CubeSats exist before launch, during ground operations. However, when looking at the entire life cycle, the CubeSat developer must also 8

33 consider the hazards their system may pose to personnel after the mission ends. Specifically, depending on the material, some CubeSat components may survive reentry and present a nonzero probability of casualty. This potential hazard is discussed in the section titled End-of-Life: De-orbit and Re-entry in Chapter VII. During orbital operations, risk of collision with manned spacecraft such as space stations and crew transport vehicles must also be addressed. This potential hazard is grouped with the hazards that are posed to other orbiting spacecraft in the section titled Collision with Third Party Satellites in Chapter VII. Potential Hazards to the Primary Mission CubeSats generally secure launch opportunities as secondary payloads on launch vehicles that were otherwise dedicated to a primary payload. While this allows for a reduced cost of access to space, the launch integrator must work with the CubeSat providers to ensure that the CubeSat missions do not present undue risk to the primary mission. Risks to the primary mission include risk to the primary spacecraft as well as risk to the launch vehicle since the primary mission depends on the launch vehicle. Risk to the primary mission includes risks that are present during launch and orbital operations, but also risks present during ground operations. Damage to the launch vehicle during ground operations may not always cause loss of the primary mission, but such an incident may cause the launch date to slip due to repairs and requalification. One obvious hazard related to many propulsion system architectures is the risk of explosion. Just as an explosion could cause casualties during ground operations, it could also damage hardware that is critical to the primary mission. Energetic materials or benign materials stored under pressure could carry the risk of explosion. Structural margins and failure modes play a major role in containment of hazardous and pressurized materials. These potential hazards are discussed in Chapter V RANGE SAFETY. Certain materials may damage hardware through contamination regardless of their toxicity or ability to explode. These materials may interact with incompatible materials that are 9

34 present on the primary spacecraft, the launch vehicle, the P-POD, or even other CubeSats. Contamination may cause effects such as corrosion and sensitivity degradation to onboard sensors. Optics may be especially sensitive to certain contaminants. This topic is also addressed in Chapter V RANGE SAFETY. Unlike other subsystems, propulsion systems carry the risk of collision with the host vehicle. Suppose that a CubeSat were to separate from the launch vehicle upper stage and after five seconds the propulsion system began firing. Depending on the separation velocity and direction and the performance of the propulsion system, the CubeSat could turn around and collide with the launch vehicle. For certain missions, the primary satellite may be at risk in addition to the launch vehicle upper stage. Some low-thrust CubeSats could not overcome the initial separation velocity in the short term, but others may be more capable. Certain measures can be taken to contain this potential hazard, as discussed in the section titled Collision with the Host Vehicle in Chapter VII. Potential Hazards to Third-Party Spacecraft CubeSats have always carried some risk of jeopardizing the missions of third party satellites. However, with the ability to augment their trajectory, self-propelled CubeSats have a greater ability to either reduce or exacerbate the potential hazards. CubeSats have always been capable of drifting into a collision course with another satellite. However, non-propulsive CubeSats can be more easily tracked in Low Earth Orbit (LEO) and the spacecraft at risk can receive timely notification and take corrective action. Self-propelled CubeSats, on the other hand, may be able to change their trajectory rapidly and collide with other satellites before the conjunction can be predicted and before a collision avoidance maneuver can be executed. The situation become even more serious when the CubeSat is capable of intercepting a manned spacecraft. The risk of collision with third-party satellites is discussed in the section titled Collision with Third Party Satellites in Chapter VII. The topic of trackability is also discussed in Chapter VII. 10

35 Self-propelled CubeSats may be intentionally controlled so as to put other spacecraft at risk. The author does not suggest that any members of the CubeSat community would foster malicious intent, but that an unauthorized party may hijack a CubeSat. The discussion titled Command Security addresses this topic in Chapter VII. Finally, as with all satellite systems, CubeSats developers must strive to mitigate the growing problem of space debris. CubeSats with propulsion systems may carry extra risk due to their ability to collide with other satellites, as discussed above, and their tendency to store energy. Should a particle of space debris impact a CubeSat containing a pressurized fluid or energetic material, the impact could cause the pressurized components to burst or the energetic material to explode. The result could add more debris to the orbital environment and jeopardize other spacecraft. Sometimes a mission cannot be completed without a pressure system, but any pressure or propellant systems should be rendered inert at the earliest point possible. The topic of passivation is discussed in the section titled End-of-Life: Passivation in Chapter VII. That section also addresses the risk of casualty due to impact by components that fail to disintegrate during reentry. Propulsion Systems Available or Under Development Not every self-propelled CubeSat presents all of the hazard discussed in the previous section. To understand the spectrum of hazards presented by various micro-propulsion systems, one must familiarize themselves with the state of the art. This discussion introduces the reader to a collection of propulsion systems that are either under development, on the market, or could become available to CubeSat developers in the foreseeable future. Chapter VI RANGE SAFETY CASE STUDIES offers basic architectures for hypothetical systems which may resemble some of the systems discussed here. The author reviewed each case with an engineer from Range Safety at Vandenberg Air Force Base. For each 11

36 case, the author discusses the hazards to Range Safety which are presented by that particular system and offers an appropriate method for responding to those hazards. The discussion given here presents information which was gathered concerning the following types of micro-propulsion systems: Cold Gas Thrusters (Physical Propulsion) Resistojet (Physical / Electric Propulsion) Mono-Propellant Thrusters (Chemical Propulsion) Electrospray (Electric) PPT (Electric) Ion Thrusters (Electric) MEMS Solid Rocket Motor (Chemical) Vacuum Arc Thruster (Electric) This list is not intended to be exhausted. Certain types of systems were knowingly left out such as Field-emission Electric Propulsion (FEEP), Hall Effect Thrusters, and Colloid Thrusters. However, this discussion is intended to illustrate the variety of CubeSat propulsion systems under development. The reader is encouraged to search the references which are cited throughout this discussion. Some of the systems that were studied pose significant risk. For example, monopropellant hydrazine thrusters pose a serious health risk to the individuals involved in integration, testing and fueling. Some systems seem to pose relatively little risk. For example, Pulsed Plasma Thrusters (PPT) and Vacuum Arc Thrusters use inert solid propellants. Their design does not require the use of hazardous materials, nor does the design require a pressure vessel. Some familiar examples of propulsion systems are not highlighted here because the author has not found that they have been studied extensively for CubeSat applications. For example, bi-propellant systems carry all of the risks of a mono-propellant system with added risks related to their complexity and explosive nature. The author does not expect that bi-propellant systems will be employed in the near future. Initial findings demonstrate that several organizations have taken initiative to develop their own propulsion system. Some groups have even begun qualification testing of their system. 12

37 Propulsion systems with inert solid propellants appear to be the least hazardous. These include PPT s and Vacuum Arc Thruster. Beyond the inherent risks associated with producing a change in velocity, V, and the risk of premature electric discharge, these systems do not pose any additional risks known to the author. Of the systems which require fluid propellants, those which utilize inert liquid (or two-phase) propellants are likely the least risky. Colloid Thrusters would only need to maintain one atmosphere of pressure. Some two-phase cold-gas thrusters require less pressure than single-phase systems. Cold Gas Thrusters (Physical Energy) Cold gas thruster propellants, with some exceptions, are not very toxic and are inert. The primary foreseeable risk is their reliance on pressurized propellant, which must be contained in pressure vessels. Research has been done to decrease propellant storage pressure, specifically for the purpose of reducing the risk to the primary satellite on the launch vehicle. This includes a study which examined the use of two-phase fluids such as Nitrous Oxide, Butane, and Refrigerant R134a. A two-phase fluid can be stored as a liquid-vapor mixture. This reduces the storage pressure required for high propellant masses while providing a vapor pressure which degrades relatively slowly. These are sometimes referred to as self-pressurizing cold-gas thrusters (Pahl, 2010). Research has been conducted concerning the use of dual two-phase materials. One twophase material would offer itself as the propellant and one two-phase material would be the pressurant. The two materials would be separated by a membrane. This allows for more constant thrust throughout the thruster life (Burges, Hall, & Lightsey, 2012). Chapter VI RANGE SAFETY CASE STUDIES presents a case study for a hypothetical cold gas thruster using Nitrogen gas as a propellant. 13

38 Resistojet (Physical, Electric) To improve the performance of a cold gas thruster, one might add a heater to raise the energy of the propellant before accelerating it through the nozzle. This type of thruster is often referred to as a resistojet. This method can be used with conventional cold gas thrusters using gases such as Nitrogen, but they can also be used with two-phase propellants such as R-134a. Busek currently markets a resistojet system for CubeSat applications which uses ammonia as a two-phase self-pressurizing propellant, which fits within a 1U volume (Busek Space Propulsion and Systems, 2013). Vacco also markets a resistojet thruster which can be scaled for varying propellant tank sizes (Vacco, n.d.). Chapter VI RANGE SAFETY CASE STUDIES presents a case study for a hypothetical resistojet system using R-134a as a propellant. Monopropellant Thrusters (Chemical Energy) Mono-propellant thrusters normally provide better mass efficiency than cold-gas thrusters. Stellar Exploration has designed a hydrazine-based mono-propellant thruster which fits within the envelope of a 1U CubeSat, intended for use on a 3U CubeSat (Biddy, 2009). Aerojet Rocketdyne also markets a line of monopropellant systems which use hydrazine as well as some that use AF-M315E as a green propellant. Aerojet Rocketdyne advertises that these systems are capable of generating up to 539 m/s of V (Aerojet Rocketdyne, 2013). Hydrazine provides very good performance, but it is a known toxin. Hydrogen peroxide, which is generally less hazardous than hydrazine, can also be used as a monopropellant. As mentioned above, Aerojet Rocketdyne has developed monopropellant thrusters capable of using a less toxic green propellant known as AF-M315E. Chapter VI RANGE SAFETY CASE STUDIES analyses hypothetical monopropellant systems using each of these propellants. 14

39 Electrospray (Electric) Electrospray propulsion systems use electric power to accelerate an ionic fluid propellant to produce thrust. Busek markets such a system which uses a collection of valves and conduits to manage the propellant (Busek Electrospray Thrusters, 2013). MIT has developed a system which uses capillary forces to contain the propellant (ion Electrospray Propulsion System for CubeSats (ieps), 2013). Two examples of hypothetical electrospray systems are discussed in Chapter VI RANGE SAFETY CASE STUDIES. One case uses an ionic liquid called EMI-BF4 as the propellant while the other uses Gallium. While EMI-BF4 poses little risk, Gallium is very corrosive to Aluminum (Material Safety Data Sheet Gallium, 2010). Pulsed Plasma Thrusters, PPT (Electric) Pulsed Plasma Thrusters (PPT) offer many safety advantages when compared with other propulsion systems. PPTs use electric discharge to ablate and vaporize a solid propellant, often Teflon. The vaporized propellant is then accelerated using an electric field (Clyde Space, 2011). Pulsed Plasma Thrusters (PPT) can be scaled for low power consumption. The propellant, sometimes simply a block of Teflon, can be stored easily without a pressure vessel. Mars Space Ltd has invested resources toward qualifying their system for use on CubeSats. They have successfully performed qualification vibration testing. When their paper was presented at the Spring 2012 CubeSat Workshop, testing was underway which included EMC, thermo-vacuum and lifetime testing (PPTCUP - Pulsed Plasma Thruster for CubeSats (Pamphlet), 2012). Clyde Space and Mars Science jointly market a PPT system for CubeSats (Clyde Space, 2011). Chapter VI RANGE SAFETY CASE STUDIES presents a hypothetical Pulsed Plasma Thruster which uses Teflon as the propellant. 15

40 MEMS Solid Rocket Motor (Chemical Energy, MEMS) Researchers have tested a very small solid rocket propulsion system fabricated using Microelectromechanical Systems (MEMS) technology (Larangot, Conédéra, Dubreuil, Do Conto, & Rossi).While this system carries some of the same risks as normal solid rocket motors, the risk may exist on a smaller scale. Ion Thrusters (Electric) An ion propulsion systems uses electric fields to accelerate positively charged ions through a grid. As the propellant, designers normally prefer inert gases with high atomic weights such as Xenon. The propellant may be ionized through electron bombardment from an internal cathode or by a microwave source. After acceleration through the charged grid, the high speed ion beam is neutralized by electrons emitted by an external cathode. The high exhaust velocities that ion thrusters achieve can provide an excellent specific impulse compared with chemical systems. Therefore, ion thrusters can be very mass efficient with their propellants. Ion thrusters, along with many electric propulsion systems, do not rely on the chemical energy of the propellant. Instead, the energy used to propel the spacecraft comes from the power system. To avoid the hazards associated with storage of energetic materials, satellites using electric propulsion systems can launch in an inert state, then harness solar energy to power their propulsion system. Busek is currently working on such a system which uses microwaves to ionize the propellant (Busek RF Ion Thruster, 2013). Chapter VI RANGE SAFETY CASE STUDIES discusses a hypothetical Ion Thruster which uses Xenon as its propellant. Vacuum Arc Thrusters (Electric) A Vacuum Arc Thruster functions by evaporating a solid propellant using an electric arc, then allowing the plasma plume to expand into the vacuum of space. The expansion provides a propulsive momentum exchange. Some work has been done to constrain the exhaust using a 16

41 magnetic field. Rather than allowing the plume to expand radially in one hemisphere, the magnetic field would force the plume to expand more-or-less axially. This would improve mass efficiency by focusing the momentum of the exhaust closer to the desired thrust direction (Keidar, et al., 2005). A study has examined using a CubeSat s Aluminum structure as a propellant (Schein, Gernhan, Rysanek, & Krishnan). Similar to Pulsed Plasma Thrusters, Vacuum Arc Thrusters conveniently rely on inert solid propellants and do not need pressure vessels. Objective As discussed in the beginning of this document, the goal of this research project is to enable CubeSat developers to safely and responsibly incorporate propulsion systems into their designs. Through the development of safety standards, the Cal Poly CubeSat program wishes to establish norms with which the CubeSat community can build a reputation for safety in ground operations, orbital operations, and disposal of propulsive designs. This document serves two primary purposes. First, the document contains rationale behind each proposed safety standard. The author intends to submit these proposed standards to the CubeSat Standards Committee. Secondly, this document offers guidance to the CubeSat developer who wishes to achieve propulsive capabilities but cannot yet visualize the path to launch readiness. The CubeSat developer is encouraged to consider the validity of the assumptions that the author makes when assessing the level of safety of their particular mission. The author wishes illuminate a path to qualification and the potential consequences of certain decision. The CubeSat developer can then better navigate their trade space and plan a realistic mission timeline. Scope Most CubeSats that will launch in the foreseeable future fly as secondary payloads. As miniaturized launch vehicles enter the scene, CubeSats may acquire access to space as primary payloads, or co-payloads. Many of the topics discussed in this study apply equally in both 17

42 situations. However, the author caters most directly to CubeSats that fly as secondary payloads. Regardless of their launch method, all CubeSats should respond appropriately to their responsibility to never create undue risk to human life, and to cooperate with norms of behavior to maintain orbital safety. Much of this study relies on deterministic analyses that the author has conducted to identify the feasibility that hazards exist under certain conditions. The author would have preferred to also conduct probabilistic analyses to determine the likelihood of those mishaps which are feasible. Unfortunately, such analysis would have taken too much time, given the computational resources available to the author. Fortunately, much can be learned from deterministic analysis. In some cases, safety envelopes are identified where the hazards do not exist. If CubeSat designs fall within those safety envelopes, probabilistic analysis is not necessary in order to adequately contain the hazards. Disclaimer At this time, any standards or requirements that are proposed in this document are in draft form and should not be used for mission planning purposes without consultation with the launch provider or the auxiliary payload integrator. The author hopes that the reader will find the discussions contained in this document useful as he or she assess the risks associated with their particular mission. For updates regarding the release of standards and requirements related to the CubeSat Design Specification (CDS), visit the Cal Poly CubeSat Program s website, About this Document This document builds arguments for a set of proposed safety standards that the author believes could help CubeSat providers to respond appropriately to the hazards that their selfpropelled CubeSat designs may pose. In addition to that, the author hopes that CubeSat developers will find the discussions throughout the document useful in navigating their trade 18

43 space. The discussions throughout the document should help the CubeSat developer to visualize the path to flight readiness. The proposed standards are all contained in APPENDIX B Draft of Standards at the end of this document. Each standard is also included in Chapter VIII PROPOSED STANDARDS. In that chapter, each standard is presented along with a discussion which offers rationale for each. The rationales often reference discussions in other chapters of this document. After the Chapter I INTRODUCTION concludes, Chapter II begins with a discussion of the methodology the author used to form the draft of standards. This includes a discussion of the intentions of the CubeSat Standards community and discussions of the strategy the author used to conduct his analysis and research. Chapter III EXISTING STANDARDS begins a review of the various standards that already exist. These documents are published by authorities such as the Air Force, the FAA, NASA, and the Cal Poly CubeSat Program. Next, Chapter IV CONCEPTS IN SYSTEM SAFETY discusses essential topics in systems safety which will help the reader to understanding the discussions that follow. The chapter defines the various levels of hazard severity, the fault tolerances needed to adequately contain hazards at each severity level, and shows how to use inhibits to satisfy fault tolerance requirements. These concepts apply for all CubeSat missions, regardless of whether their satellite contains a propulsion system. Chapters V through VII analyze the hazards that CubeSat developers should consider when designing their propulsion systems. The research and analyses in these chapters provide a basis for some of the safety standards which are proposed in this document. The author hopes that the CubeSat provider will find these chapters very helpful when assessing the potential hazards that are relevant to their particular satellite, and when exploring ways to contain those hazards. Chapter V RANGE SAFETY discusses those potential hazards which may exist during ground operations, transportation, and launch up until the point when the CubeSat separates from 19

44 the host vehicle. Much of that chapter focusses on the relevant requirements given in AFSCPMAN , with a focus on pressure system safety and verification. Chapter VI RANGE SAFETY CASE STUDIES puts the concepts of systems safety and Range Safety into practice using a case study. Range hazards are difficult to characterize definitively. Each satellite presents a unique set of challenges that Range Safety must become comfortable with before that satellite can be approved to fly. Kevin Case, who works for Range Safety at Vandenberg Air Force Base (VAFB) met with the author to discuss each case and to provide his perspective. Each case introduces a hypothetical CubeSat propulsion architecture. The hazards of each architecture are identified with some discussion of the severity of each hazard. A hypothetical inhibit design is given for each case which is likely to adequately contains those hazards. Each case also includes a discussion of the analysis and testing that would be required to prove flight worthiness of the architecture. The author hopes that CubeSat developers can find similarities between their particular propulsion system options and some of the hypothetical systems. Perhaps one case will resemble their propellant choice while another case resembles their propellant containment method. The cases should help the developer to make preliminary estimates of how their particular systems may be treated by Range Safety. Chapter VII ORBITAL SAFETY discusses those hazards that may be present from the time a CubeSat separates from the host vehicle until the End-of-Life (EOL) and disposal of the satellite. Several analyses are given which assess the potential hazards of collision with the host vehicle after separation and collision with third party satellites. Concepts relating to trackability in orbit are discussed along with recommendations for helping the Joint Space Operations Center (JSpOC) to track CubeSats more easily and provide collision avoidance. Recommendations are also given for establishing contact with the JSpOC in order to establish a plan for assessing the hazard of collision with other objects before executing a maneuver. Chapter VII also discusses the concepts relating to EOL safing and satellite disposal operations, which are essential to the mitigation of orbital debris. 20

45 II. METHODOLOGY This chapter discusses the approach the author uses to evaluate hazards, determine methods of reducing or controlling those hazards, and write the safety standards proposed in this document. Flow from Existing Standards Many of the hazards that a CubeSat propulsion system may pose have been previously evaluated by the wider aerospace industry. Rather than reinventing the wheel, many of the safety standards proposed in this document flow from existing standards. In fact, CubeSats will already be held to requirements given in some of the existing documents such as those relating to Range Safety. In those cases, the author attempts take those general standards and apply them specifically for CubeSats and determine the limits of applicability. In cases where the general standards do not apply well to CubeSat missions, alternatives should be sought which preserve the intent of the original requirements and achieve an equivalent level of safety. CubeSat Standards Committee s Desires On May 23 rd, 2013, the Cubesat Standards Committee met and discussed the possibility of eventually publishing standards to help guide CubeSat developers to incorporate propulsion systems into their designs in a safe and responsible manner. The author attended the meeting by teleconference. Swim-Lanes Much emphasis was given to the concept of defining swim-lanes, in which standards would be organized into tiered categories based on the feasibility of certain hazards. CubeSats which present different hazards would be subject to different requirements. For example, a CubeSat capable of generating 1 m/s of V would be subject to less stringent requirements compared to a CubeSat capable of generating 1 km/s of V, because the more capable satellite 21

46 could feasibly intersect the orbits of more satellite. The requirements specified for each swim lane would be appropriate to the severity of the potential hazards that exist. While the author notes the merit in defining swim lanes to distinguish the benign from the hazardous, he has not yet identified clear boundaries which can be used to group CubeSat designs into groups across multiple dimensions. Instead, many of safety standards which are proposed in this document depend on the existence of certain individual hazards, rather than multiple hazards. Positive Control The requirement for positive control was also emphasized at the CubeSat Standards Committee meeting, which relates to command security. A well-controlled satellite with poor command security could be hijacked and used as a weapon. This topic is discussed in the section titled Command Security in Chapter VII. Range Safety vs. Orbital Safety The Standards Committee noted that certain requirements pertain to safe launch and prelaunch operations while other requirements pertain to on-orbit safety. The committee emphasized an interest in promoting good citizenship on orbit. This topic is discussed throughout Chapter VII ORBITAL SAFETY. Implementation The Cal Poly CubeSat program wishes to respond to the desires of the CubeSat Standards Committee by proposing a framework for defining safety standards for self-propelled CubeSats. The standards are divided in to Range Safety standards and Orbital Safety standards. The topic of Range Safety is discussed in detail in Chapters V and VI while the topic of Orbital Safety is covered in Chapter VII. Whenever possible, the author has identified boundaries to safety envelopes where particular hazards are not feasible. 22

47 Analysis The author conducted a collection of analyses which help to assess the feasibility of certain hazards under a range of conditions. As mentioned in the previous chapter, this research does not focus on modeling the probability of hazards. Probabilistic analysis often requires advanced computing resources. Instead, the author conducted deterministic analyses to determine the feasibility and the severity of each hazard. This allows for the formulation of safety zones where certain hazards do not exist. For the envelopes where hazards are feasible, future research may wish to explore the probability of mishap. Given the severity of the hazard, one could then determine envelopes of acceptable risk. 23

48 III. EXISTING STANDARDS As mentioned in Chapter II, many of the hazards that a CubeSat propulsion system may pose have been previously evaluated by the wider aerospace industry. Rather than reinventing the wheel, many of the safety standards proposed in this document flow from existing standards. This chapter introduces current standards which pertain to CubeSat propulsion systems. These documents are published by the Cal Poly CubeSat program, the Air Force Space Command, the National Aeronautics and Space Administration (NASA), and the Federal Communications Commission (FCC). CubeSat Design Specification (CDS) First, it is worthwhile to consider the current revision of the CubeSat Design Specification (CDS), Revision 12, in order to identify the current requirements which may pertain to micro-propulsion systems. Table 1 lists some requirements from CDS which may restrict some forms of micro-propulsion. Note that these requirements are included in the current revision of the CDS, but may be adjusted in future releases in order to better accommodate propulsion systems. Many of the comments in Table 1 suggest that these requirements may need to be modified in order to allow certain propulsion systems to fly in the P-POD. That is why this project is important. We hope to help the CubeSat community to develop capabilities which may not be supported by the current revision of the CDS. Rather than deleting certain requirements, we wish to modify the requirements to accommodate new capabilities while maintaining an acceptable level of safety. Certain other requirements in the CDS may not explicitly rule out some propulsion systems, but would apply to propulsion systems. With examination of these topics throughout this project, some of these requirements may also need to be modified in order to support certain propulsion system designs. 24

49 Table 1: Potentially restrictive requirements from the CDS (CubeSat Design Specification Rev. 12, 2009). No. Requirement Text Comments All parts shall remain attached to the CubeSats during launch, ejection and operation. No additional space debris shall be created. This requirement may restrict certain propulsion systems which generate solid debris in the exhaust Pyrotechnics shall not be permitted. This directly restricts chemical propulsion systems which operate by combustion No pressure vessels over 1.2 standard atmospheres shall be permitted Total stored chemical energy shall not exceed 100 Watt-Hours No hazardous materials shall be used on a CubeSat This requirement severely limits both physical and chemical systems which store propellant in pressure vessels. This does not limit the use of PPT s. This requirement could be replaced by the proposed safety standards which pertain to pressure systems. This requirement could limit use of chemical propellants. This requirement could also be replaced by some of the proposed standards. This requirement would limit the choices for propellant. Propellants such as hydrazine and hydrogen peroxide would be considered hazardous. This requirement could also be replaced by some of the proposed standards. 25

50 Table 2: Other applicable requirements from the CDS (CubeSat Design Specification Rev. 12, 2009). No. Requirement Text Comments Pressure vessels shall have a factor of safety no less than 4. This requirement is very conservative in comparison with the requirements in AFSPCMAN which call for pressure vessel safety factors greater than 1.5, or sometimes above 2.0. See the section titled Pressure Vessel Verification in Chapter V of this document Aluminum 7075 or 6061 shall be used for both the main CubeSat structure and the rails. If other materials are used the developer shall submit a DAR and adhere to the waiver process. Some pressure vessels may require the use of other materials, but this requirement suggests that exceptions may be permitted if a waiver is granted. The CubeSat developer should be mindful of any possibility of casualty during reentry. See the section titled Tank Material and Orbital Debris Assessment Report in Chapter VII of this document All deployables such as booms, antennas, and solar panels shall wait to deploy a minimum of 30 minutes after the Cubesat s deployment switch(es) are activated from P-POD ejection. While propulsion systems are not deployables, this time restraint could be used as a model. Perhaps propulsion systems should not be activated until after the CubeSat has sufficiently separated from the host vehicle. See the section titled Collision with the Host Vehicle in Chapter VII of this document The orbit decay lifetime of the Cubesats shall be less than 25 years after end of mission life. Propulsion systems may actually help CubeSats to satisfy this requirement. However, operators should be careful not to maneuver there satellite into a trajectory where they cannot effectively deorbit within 25 years. 26

51 Future revisions of the CDS Deployer designs and the CubeSat Design Specification may impact the feasibility of launching a micro-propulsion system. New revisions of the CDS will allow CubeSat developers to use a tuna-can shaped space which extends into the pusher plate of the P-POD. In addition, larger-than-3u deployers may increase demand for propulsion systems, increase feasibility, and affect propulsion system configuration trades. For example, a larger spacecraft may make the use of multiple thrusters for attitude control more feasible. At the time of this publication, a provisional release of CDS Rev. 13 can be found at CubeSat.org. AFSPCMAN : Range Safety User Requirements The Range Safety User Requirements document, AFSCPMAN , is of supreme importance for CubeSat propulsion systems, and is cited frequently in Chapters V and VI of this document. According to the introduction in Chapter 1, the objective of AFSPCMAN is to establish and enforce Range User safety requirements to ensure that the public, launch area, and launch complex personnel and resources are provided an acceptable level of safety and that all aspects of prelaunch and launch operations adhere to applicable public laws (AFSCMAN Vol. 1, 2004). AFSPCMAN does not pertain to orbital safety after launch, but treats prelaunch and launch operations extensively. AFSPCMAN Volume 3 Launch Vehicles, Payloads, and Ground Support Systems Requirements is of particular importance to CubeSat missions, especially propulsion systems. Chapter 10 of that volume, titled Hazardous Materials, may apply to some propulsion systems while Chapter 12, titled Flight Hardware Pressure Systems and Pressurized Structures, pertains directly to many CubeSat propulsion systems. The document outlines the required design, analysis, and testing that are required to demonstrate an appropriate level of safety (AFSPCMAN Vol. 3, 2004) 27

52 All CubeSats, with or without propulsion systems, that launch from the Eastern and Western Range of the United States will submit a Missile System Prelaunch Safety Package (MSPSP) to Range Safety before receiving approval to fly. As described in Attachment 1 of Volume 3, the MSPSP is used to communicate the potential hazards of the CubeSat and the ways in which those hazards are contained in order to achieve an acceptable level of safety (AFSPCMAN Vol. 3, 2004). Traditionally, Cal Poly and its subcontractors have aided the CubeSat providers in working with Range Safety and the Launch Vehicle Provider to achieve an appropriate level of safety and obtain approval to fly from Range Safety. Chapter 3 of Volume 3 offers guidance for containing hazards that are not specifically outlined in other chapters. Specifically, the very short chapter provides guidance in identifying the number of inhibits that are required to contain hazards of various severity (AFSPCMAN Vol. 3, 2004). The topics that are addressed in Chapter 3 of AFSPCMAN are discussed in this document, under Hazard Severity and Fault Tolerance in Chapter IV. Volume 6 pertains directly to the safety of ground and launch operations (AFSPCMAN Vol. 6, 2004). Many of these requirements do not strictly apply to CubeSats since they are usually integrated to the P-POD prior to transportation to the range. It is the responsibility of the CubeSat provider to establish safety standards for use in their own facilities. Some requirements in Volume 6 do pertain to CubeSats containing hazardous materials, as is discussed in the section titled Pressure Vessel Verification in Chapter V. AFI : Space Safety and Mishap Prevention Program According to Section 1.1 of AFI , the document implements space safety, mishap prevention and mission effectiveness guidance for AF space systems, with coverage of topics such as re-entry, space control systems, and orbital safety. Chapter 5 of AFI , which pertains to Orbital Safety, covers collision avoidance, space debris, and End-of-Life (EOL) procedures among other things. Of particular interest is the discussion on collision 28

53 avoidance which describes the role played by the Joint Functional Component Command for Space (JFCC SPACE) through the Joint Space Operations Center (JSpOC). Section 5.2 of AFI discusses the maximum allowable probability of collision with other objects. For example, according to , satellites may not exceed a probability of impact greater than 1 x 10 6 per spacecraft for manned spacecraft. In comparison, the maximum allowable probability for collision with unmanned active spacecraft is 10 x 10 6 per object, according to (AFI , 2010). Section 5.9 discusses Conjunction Assessment (CA) and Section 5.10 discusses Collision Avoidance (COLA) (AFI , 2010, p. 49). Section reads, Consistent with mission capabilities and resource availability, conjunction assessments will be conducted for all active spacecraft against all satellite catalog objects within JSpOC established threat thresholds. These thresholds are typically identified by a miss distance, but other criteria may be used, as appropriate. (AFI , 2010, p. 49) CubeSat operators that wish to perform propulsive maneuvers should contact JFCC SPACE for assistance in performing a CA. Early on in the program, CubeSat providers should establish communication with JFCC SPACE by working with their launch integrator or launch provider to submit an Orbital Data Request (ODR) to ODR@space-track.org for services including Collision Avoidance and Conjunction Assessment. The ODR form and instructions can be found at (Orbital Data Request, 2013). The ODR submittal represents the first contact between the CubeSat program and JFCC SPACE. Once the ODR has been submitted, JFCC SPACE will contact the CubeSat operator and provide a point of contact when two-way communication becomes necessary (Quinonez, 2013). 29

54 The CubeSat operator may wish for guidance in discerning between significant levels of V which require a CA and COLA, and benign levels of V which do not. Section of AFI reads, Each spacecraft operator, in coordination with the wing Safety Office, JFCC SPACE and 14 AF/SE, will develop thresholds (eg. Very low Delta-V ( V) maneuvers) within which no CA/COLA is required. (AFI , 2010, p. 49) The threshold at which a CA and COLA are required may depend on the mission. The CubeSat provider should work with their launch integrator, launch provider, and JFCC SPACE to set a threshold for their particular mission. According to Richard C. Diamantopoulos who works for Scitor Corporation in support of JFCC SPACE, customers of are notified that satellites are screened for collision avoidance using a 1 km (X, Y-axes) x 200 m (Z-axis) [ellipsoid] around the current [element set]. Any movement from a currently established [element set] in the Satellite Catalog without prior coordination with the JSpOC affects their ability to predict conjunctions and avoid collisions until the new [element set] is confirmed in the Satellite Catalog (Diamantopoulos, Correspondence, 2013). The topic of trackability and collaboration with JFCC SPACE is discussed further in the section titled Trackability in Chapter VII. AFSPCI : Satellite Operations The Air Force Space Command (AFSPC) Instruction on Satellite Operations defines organizational responsibilities for AFSPC-conducted satellite operations (AFSPCI , 2009, p. 2). The document claims the Air Force Space Command s responsibility for all aspects of providing satellite capabilities to support various Department of Defense (DoD), National and civil agencies and is responsible for organizing, training and equipping the space 30

55 operations infrastructure (AFSPCI , 2009, p. 2). The document may prove helpful to the CubeSat provider who wishes to identify the authority within Space Command that can aid in a particular issue. Due to the document s emphasis on defining organizational responsibilities, it does not devote much space to technical discussions. However, in certain sections the document does provide brief technical rationale for the importance of the responsibilities it defines. Satellite Disposal Section 3.6 identifies that the objective of satellite disposal is to reduce the potential for spacecraft collisions and frequency interference, to mitigate the creation of additional space debris and to open orbital slots to newer [Satellite Vehicles]. Furthermore, the same paragraph emphasizes the need to ensure that every satellite maintains its disposal capability. The paragraph continues, This includes assured [Telemetry, Tracking and Commanding] and sufficient fuel to reach the disposal region (AFSPCI , 2009, p. 11). Therefore, while a de-orbit plan must be in place before launch, the spacecraft operator must be watchful of the onboard resources to identify any need for early disposal. For example, suppose that a CubeSat requires 10 grams of propellant to accomplish a de-orbit maneuver at End-of-Life (EOL). If an anomaly should persist which consumes propellant for station keeping or momentum dumping at a higher rate than designed, the CubeSat operator may need to cut the mission short when the propellant level reaches 10 grams. Of satellite safing, Section requires, the [Space Wings] will deplete all spacecraft fuel to the maximum extent possible, disable all spacecraft battery charging systems, stabilize the spacecraft in a neutral thermal flight mode (slow spin for most) and, when appropriate, disable transmitters. The paragraph concludes claiming that safing the satellite takes precedence over all other disposal actions (AFSPCI , 2009, p. 13). 31

56 FCC Policies The Federal Communications Commission (FCC) plays an important role in the CubeSat community. Non-government CubeSats apply for frequency licenses with the FCC. Before granting a license to transmit, the FCC requires the submittal of an Orbital Debris Assessment Report (ODAR), as discussed in the section titled End-of-Life: De-orbit and Re-entry in Chapter VII of this document. Non-government CubeSats may work through the National Telecommunications and Information Administration (NTIA) and their respective spectrum manager to obtain a transmission license, and may or may not be held to the same orbital debris mitigation requirements as non-government CubeSats. The FCC published a Public Notice on March 15, 2013, titled Guidance on Obtaining Licenses for Small Satellites. In it, the FCC describes its policy for small satellites which present a non-zero probability of casualty due to debris that survives reentry. This policy is also discussed in greater detail in the section titled End-of-Life: De-orbit and Re-entry in Chapter VII. NASA STD : Process for Limiting Orbital Debris NASA offers requirements for limiting orbital debris generation in NASA STD This document discusses the requirements associated with the Orbital Debris Assessment Report (ODAR), which can satisfy a requirement to supply orbital debris documentation to the FCC (NASA-STD A: Process for Limiting Orbital Debris, 2012). This topic is discussed in greater detail in the section titled End-of-Life: De-orbit and Re-entry, in Chapter VII. 32

57 IV. CONCEPTS IN SYSTEM SAFETY This chapter discusses various concepts in system safety as they apply to CubeSat propulsion systems, including the proper response to hazards, hazard severity assessment, fault tolerance requirements, and the use of inhibits to satisfy fault tolerance requirements. In order to frame the discussion, consider the definition for safety as given in the NASA System Safety Handbook, Safety is freedom from those conditions that can cause death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment. In any given application, the specific scope of safety must be clearly defined by the stakeholders in terms of the entities to which it applies and the consequences against which it is assessed. For example, for non-reusable and/or non-recoverable systems, damage to or loss of equipment may be meaningful only insofar as it translates into degradation or loss of mission objectives. (NASA/SP , 2011) This study does not attempt to provide guidance relating to mission assurance for the CubeSat missions themselves. While mission assurance is an important goal for any CubeSat developers, this document discusses safety of CubeSats in relationship to personnel safety and mission assurance for the primary mission that hosts the CubeSats as secondary payloads. Proper Response to Hazards The Eastern / Western Range Safety Document EWR has been superseded by AFSPCMAN , but Appendix 1B of that volume offers a useful discussion relating to the proper response to hazards. In section 1B titled System Safety Precedence, the document offers a hierarchy describing how to address hazards, thus proposing a certain philosophy for a safety program. The document proposes that once a hazard has been identified, the engineer 33

58 should first seek ways to design for minimal risk. A potential hazard would ideally be removed completely (EWR Range User Handbook, 1999). For each potential hazard that is allowed to exist, the designer should be ready to demonstrate that no feasible alternatives exist that would meet the mission requirements. In such a case, the designer should minimize the severity of that hazard. When the hazard cannot be removed, the designer should incorporate safety devices to reduce the probability of the hazards. The art of incorporating safety devices into a system design is discussed in further detail throughout this chapter. Finally, warning devices should be incorporated into the design, wherever possible, to alert operators or affected personnel of a growing danger. Safety procedures and training may also be necessary to adequately respond to hazardous situations (EWR Range User Handbook, 1999) Hazard Severity and Fault Tolerance When a potential hazard exists, the proper response is proportional to the severity of the hazard. A designer may permit less severe hazards to occur more frequently, or with fewer safety controls, while more severe hazards must be contained more fervently to protect personnel and property. AFSPCMAN Vol. 1 Figure 3.2 defines four levels of hazard severity based on the potential consequences which include personnel illness/injury, equipment loss, and unit downtime. A portion of that figure is reproduced in Table 3 below, combined with some information from Vol. 3 Chapter 3. With respect to personnel injury and illness, a negligible hazard will not result in injury or occupational illness, a marginal hazard may cause a minor injury or minor occupational illness, a critical hazard may cause injury or severe occupational illness, and a catastrophic hazard may cause death. To supplement these qualifications for hazard severity pertaining to personnel injury and illness, the reader should visit Table 3 which includes qualifications for these hazard severities in terms of equipment loss and unit downtime (AFSCMAN Vol. 1, 2004). 34

59 Table 3: Definition and implications of hazard severity (AFSCMAN Vol. 1&3, 2004). Hazard Severity* Potential Consequences* Requirements** Personnel Equipment Loss ($) Unit Inhibits Fault Category Illness / Injury Downtime Required Tolerance I Catastrophic May cause death. > 1,000,000 > 4 Months II Critical May cause severe injury or severe occupational illness. III Marginal May cause minor injury or minor occupational illness. IV Negligible Will not result in injury or occupational illness. 200,000 to 1,000,000 10,000 to 200,000 2 Weeks to 4 Months 1 Day to 2 Weeks < 10,000 < 1 Day 3 Dual 2 Single 1 No * Based on AFSPCMAN Vol. 1 Figure 3.2 ** Based on AFSPCMAN Vol. 3 Chapter 3. These requirements apply when a hazard is not explicitly dealt with in AFSPCMAN

60 As mentioned in Chapter III of this document, the Range Safety document AFSPCMAN Vol. 3 Chapter 3 offers guidance for containing hazards that are not specifically outlined in other chapters of the document. Specifically, the chapter provides guidance in identifying the fault tolerance that is required to contain hazards of various severity levels (AFSPCMAN Vol. 3, 2004). This information is useful for determining a sufficient level of control for many hazards. As summarized in the right-hand columns of Table 3, AFSPCMAN Vol. 3 Chapter 3 requires a specific level of fault tolerance for each level of hazard severity. Marginal hazards require containment, but no-fault tolerance, Critical hazards require single-fault tolerance, and Catastrophic hazards require dual-fault tolerance (AFSPCMAN Vol. 3, 2004). This document addresses the feasibility of hazards rather than the probability of hazards. However, for completeness, it is helpful to consider the maximum allowable probabilities permitted by Range Safety for a range of hazard severities. According to AFSPCMAN Volume 1 Figure 3.2, a catastrophic hazard can be permitted if the risk extremely permissible, defined by a probability of occurrence less than 8 x A waiver from Range Safety would be required if the catastrophic hazard is a remote probability, defined by a probability of occurrence of between 8 x 10-5 and 8 x A critical hazard may be permitted with a remote probability, but requires a waiver if the hazard could occur occasionally, defined by a probability between 8 x 10-4 and 8 x A marginal hazard may be permitted with occasional occurrence, but a waiver would be required for probabilities greater than 8 x 10-3 (AFSCMAN Vol. 1, 2004). Non-Credible Hazards Some organizations that host CubeSat launches stress the advantages of a dual-fault tolerant design. When a CubeSat provider demonstrates that system contains a potential hazard with dual-fault tolerance, that hazard is categorized as non-credible. The severity of that noncredible hazard becomes unimportant because a dual-fault tolerant design can adequately contain 36

61 even a catastrophic hazard. Therefore, the task of assessing the hazard severity can be circumvented, which may permit significant cost savings and schedule security for the mission. Inhibits The reader may notice that Table 3 associates levels of fault tolerance with a required number of inhibits. An inhibit is a device that removes the potential for a hazard to occur. The device would need to fail in order for the hazard to propagate until that device is legitimately controlled to allow the hazard to propagate. Two or more inhibits are independent if they function in series with one another and if they do not rely on a common control. In contrast, a dependent inhibit might operate in parallel with another inhibit or it may rely on a common control. Addition of a dependent inhibit does not improve fault tolerance since a single failure could compromise two inhibits. By definition, for any two independent inhibits, there cannot exist a single-point-offailure that would result in propagation of the hazard. Therefore, two independent inhibits are single-fault tolerant. Similarly, three independent inhibits are dual-fault tolerant. As discussed earlier, AFSPCMAN Volume 1 Figure 3.2 defines allowable probabilities for hazards of varying severity. The failure rate of inhibits should be low enough such that the total probability of the hazard propagating through all inhibits lies within the allowable probability tolerances for that hazard severity. When an electrical system can cause a hazard upon power-up, CubeSat designers often use switches as inhibits because they can interrupt the power path to the hazardous component. For example, a CubeSat designer may place a separation between the power source and a marginally hazardous radio transmitter. When the CubeSat separates from the P-POD, the switch closes and allows electrical power to flow to the transmitter. Unless the separation switch fails prematurely, electrical power cannot reach the transmitter before separation. To obtain singlefault tolerance, a CubeSat designer might include two separation switches in series. To obtain 37

62 dual-fault tolerance, a designer may add yet another switch in series that is controlled by a ground command, for example. As a side not, according to the CubeSat Design Specification (CDS) Rev. 12 Requirement 2.4.3, many CubeSat transmitters would also require a time delay of at least 30 minutes before transmission may occur (CubeSat Design Specification Rev. 12, 2009). Now consider a pressure system containing a hazardous propellant. Unlike hazardous electrical systems, here the potential for a hazard to propagate is not directly tied to the electrical power path. Suppose a propellant is chosen that would cause a critical hazard if it leaked. In such an example, the CubeSat designer would need to implement a single-fault tolerant design that prevents inadvertent leakage of the propellant. The designer might use two valves connected in series to interrupt propellant flow to the nozzle, as shown in Figure 5. If the two valves were both controlled by one onboard computer, the computer may introduce a single point of failure. In order for the inhibits to remain independent, their controls must be independent. To accomplish this, the example shown below uses a latch valve controlled by a separation switch and timer in series with the thruster valve that is controlled by the computer system. Similar measures would need to be taken to prevent leakage through the fill and drain valves. For a discussions pertaining to fill and drain valves, see the section titled Implementation in Chapter V. That section also discusses dual-seat valves. An example inhibit architectures is shown for each of the cases described in Chapter VI RANGE SAFETY CASE STUDIES. 38

63 Figure 5: Example inhibit diagram for critically hazardous propellant. 39

64 V. RANGE SAFETY As discussed in Chapter II METHODOLOGY, Range Safety and Orbital Safety will be treated separately. Most of the safety standards that will be proposed fall into one of these two realms because the hazards are unique for the two distinct phases of each mission. This chapter focuses on Range Safety while Chapter VII ORBITAL SAFETY discusses Orbital Safety. The topic of Range Safety pertains to those hazards that are present during ground operations at the Range through integration, launch, and deployment of the CubeSats. After separation from the host vehicle, the CubeSat enters the realm of Orbital Safety which, again, is discussed in Chapter VII. The majority of this chapter revolves around the requirements given in the Range Safety document, AFSCPMAN Volume 3, which is introduced in Chapter III. Many thanks are due to Kevin Case who is a Range Safety Engineer for the Western Range at Vandenberg Air Force Base in California. He possesses extensive first-hand experience with helping CubeSats providers to achieve the level of safety necessary for launch. Kevin graciously shared some of his knowledge and perspective with the author, which helped the author to better understand the intent of the Range Safety document. In this chapter, the author wishes relay those lessons to the reader in order to help the reader to understand the intent of the requirements given in AFSCPMAN Volume 3. Additionally, the chapter discusses whether, and how, certain sections of the Range Safety document apply to CubeSat propulsion systems. Hazardous Material AFSPCMAN Vol. 3 Chapter 10 applies to any system that contains materials that are either flammable, explosive, energetic, toxic, or otherwise hazardous, on their own or in interaction with other materials in the expected environments under the environmental conditions expected from ground operations through CubeSat deployment. 40

65 Proper handling of hazardous materials is especially important to CubeSat propulsion systems since many potential propellants can be classified as hazardous materials. Chemical propellants, for example, store large amounts of energy which may be released in an explosion. Some propellants are very toxic and must be handled with extreme caution if they are to be handled at all. AFSPCMAN Vol. 3 Section 10.1 requires that the least flammable material shall be used and the least toxic material shall be used (AFSPCMAN Vol. 3, 2004). This speaks to the intent that the designer should attempt to eliminate hazards. However, when a hazard cannot be eliminated completely, there must be adequate justification for the hazard. For example, if a CubeSat developer wishes to use a toxic propellant, they must be prepared to make an argument for how that propellant is the least hazardous propellant that allows for completion of mission objectives. For every potentially hazardous material, the CubeSat provider should become intimately familiar with the Material Safety Data Sheet (MSDS) or Safety Data Sheet (SDS). The vender that provides the material should be ready to supply that document which outlines information on flammability, explosion hazards, toxicity, transportation limitations, etc. Material Compatibility When considering the hazards associated with a material, one must consider the hazards that arise when that material interacts with its environment. Gallium, for example, is fairly benign to touch, but in contact with Aluminum, it can severely weaken the alloy. It is important to consider how a material may behave when exposed to each material present on the CubeSat, the P-POD, other auxiliary payloads, the primary payload, the launch vehicle, ground support equipment, and the ambient air or moisture. As a secondary payload, a CubeSat provider may not possess the clearance to know what materials are present during ground operations and launch. 41

66 The CubeSat provider must collaborate with their launch integrator, their launch provider, and with Range Safety to identify potential material incompatibilities. The CubeSat developer should also consider the impact that their design may have on the primary mission. Certain materials, for example, could contaminate critical hardware present on other CubeSats, on the launch vehicle, or on the primary payload. Spacecraft optics can be especially sensitive to contamination. Toxicity Toxicity represents a major concern for Range Safety. The CubeSat provider should seriously consider the risks associated with toxic materials since the loss of one precious human life would define a catastrophe. Materials may cause damage to the body in many different ways. To list some examples, a material may cause skin and eye burns on the surface, materials may be absorbed through the skin into the body, vapors may be inhaled, or a material may even be ingested. In some cases, a material may release a toxic gas when exposed to another contaminant. The CubeSat provider should study resources such as the MSDS or SDS before selecting any potentially toxic material. Transportation The CubeSat provider should be aware that certain materials require special shipping provision. In fact, some materials are forbidden from air travel or on the road. Since propellant must be loaded prior to integration to the P-POD, the propellant would then be transported together with the P-POD to the range. Any special provisions that are necessary drive up cost to the CubeSat, the integrator, and the launch provider. Containment of Hazardous Fluids Hazardous materials, especially propellants, are often stored in sealed containers or pressure vessels. The following section, titled Pressure Systems, discusses the requirements related to the containment of hazardous and non-hazardous fluids alike. 42

67 Spills and Vapor Monitoring When hazardous materials are used, provisions must be made to detect leakage before a hazardous situation exists. AFSPCMAN Vol. 6 Section states that vapor monitoring equipment shall be used for leak (sniff) checks and general atmosphere monitoring to determine the necessity for [personal protective equipment]. Vapor monitoring equipment shall be approved by Range Safety and is subject to approval by Bioenvironmental Engineering (AFSPCMAN Vol. 6, 2004). Pressure Systems Many propulsion system designs use pressure systems to contain a propellant. Even lowpressure propellant reservoirs that contain propellant at atmospheric pressure on the ground experience a pressure differential when they reach the vacuum of space. AFSPCMAN Vol. 3 Chapter 12 lists criteria defining those pressure systems that Range Safety considers hazardous, shown in the excerpt below. Note, however, that pressure systems that do not meet these thresholds may still present hazards that must be contained. Hazardous flight hardware pressure systems are defined as follows: (1) flight systems containing hazardous fluids such as cryogens, flammables, combustibles, and toxics; (2) systems used to transfer hazardous fluids such as cryogens, flammables, combustibles, and hypergols; (3) systems with operating pressures that exceed 100 psig; (4) systems with stored energy levels exceeding 14,240 foot pounds; and 43

68 (5) systems that are identified by Range Safety as safety critical. This chapter establishes minimum design, fabricaton, installation, testing, inspection, certification, and data requirements for flight aerospace vehicle equipment (AVE) and pressurized structures. (AFSPCMAN Vol. 3, 2004) If the pressure system does not exceed the pressure and energy levels described above, Range Safety may not hold the Range User, the satellite provider, accountable for every requirement in Chapter 12. In such cases, the requirements given in Chapter 12 will be used as a baseline and tailored to the specific hazards that may exist. At a minimum, Range Safety would require adequate demonstration of the design safety factor (by analysis or test), hazards analysis documentation, and leak checks for assembled flight hardware (Case, Corresspondence, 2013a). Pressure System Fault Tolerance Consistent with AFSPCMAN Vol. 3 Chapter 3, Section 12.2 calls for single-fault tolerance against critical hazards and dual-fault tolerance against catastrophic hazards (AFSPCMAN Vol. 3, 2004). Hazardous Pressure System Components AFSPCMAN Vol. 3 Section gives requirements for hazardous pressure system components. Pressure Vessel Verification AFSPCMAN Volume 3 treats pressure vessels specifically in Sections 12.1 through 12.3, as summarized in Figure 6. The design, analysis, and test requirements depend on the required verification approach and path. Depending on the methods used to design the pressure vessel, the satellite provider may be required to follow Verification Approach A or B (AFSPCMAN Vol. 3, 2004). 44

69 Verification Approach B applies to pressure vessels which are designed using ASME Boiler and Pressure Vessel Code or the DOT Pressure Vessel Codes (AFSPCMAN Vol. 3, 2004). It is expected that most CubeSat pressure systems will follow Verification Approach A, so Verification Approach B will not be discussed in detail here. Verification Approach A branches into Path 1 and Path 2, depending on the failure mode of the vessel and whether the fluid contained is hazardous. If the pressure vessel exhibits a leakbefore-burst (LBB) failure mode and leakage cannot create a hazardous situation, then the satellite provider may choose between path 1, shown branching to the left in Figure 6, or path 2, shown branching to the right (AFSPCMAN Vol. 3, 2004). In this case, the Range User is also free to choose path 2, shown branching to the right in Figure 6. If the pressure vessel exhibits a brittle failure mode, then the Range User must adopt path 2, shown branching to the right in the figure below Figure 6. Additionally, if leakage of the contents creates a hazardous situation, regardless of the failure mode, the vessel must adopt path 2 as well (AFSPCMAN Vol. 3, 2004). Figure 6 is taken from Figure 12.1 of AFSPCMAN Vol. 3. It summarizes the possible paths, described in Chapter 12.2, that a satellite provider may follow in order to verify their pressure vessel or reservoir (AFSPCMAN Vol. 3, 2004). Failure Mode The pressure vessel s failure mode may be characterized as either leak-before-burst (LBB), or brittle fracture. As the name implies, a LBB vessel will leak or vent its contents before bursting while a brittle fracture vessel will hold pressure until it reaches the burst pressure. Leaking Hazard If the pressure vessel exhibits a LBB failure mode, it is important to determine whether the leaked contents create a hazardous situation. Material toxicity plays a major role in this determination. It is important to develop a leak contingency plan, if applicable. 45

70 Figure 6: Pressure vessel verification approaches, taken from AFSPCMAN Vol. 3 Figure 12.1 (AFSPCMAN Vol. 3, 2004). 46

71 Sealed Containers Composite Vessel Metallic Vessel General Table 4: Applicability of AFSPCMAN Vol. 3 Ch. 12 requirements for pressure vessels and sealed containers (AFSPCMAN Vol. 3, 2004). Section(s) of Criteria for Applicability All systems containing a pressure system. Also see AFSPCMAN Vol. 3 Attachment 1 for additional guidance in preparing the MSPSP Systems containing a pressure vessel or reservoir and , and Verification Approach A Path , and Verification Approach A Path Verification Approach B , and Verification Approach A Path Verification Approach A Path Modified Path Path 2 System contains a metallic pressure vessel or reservoir System contains a metallic pressure vessel or reservoir that exhibits a LBB failure mode AND leakage of the contents cannot create a hazardous situation. Acceptable Alternative: Ch Ch System contains a metallic pressure vessel or reservoir that exhibits a brittle failure mode OR where leakage of the contents could create a hazardous situation. System contains a metallic pressure vessel or reservoir designed using ASME Boiler and Pressure Vessel Code or the DOT Pressure Vessel Codes. System contains a Composite Overwrapped Pressure Vessel (COPV). System contains a COPV that exhibits a LBB failure mode AND leakage of the contents cannot create a hazardous situation. System contains a COPV pressure vessel or reservoir that exhibits a brittle failure mode OR where leakage of the contents could create a hazardous situation. System contains sealed container that exhibits a LBB failure mode AND leakage of the contents cannot create a hazardous situation. System contains a sealed container that exhibits a brittle failure mode OR where leakage of the contents could create a hazardous situation. 47

72 Verification Approaches Within Verification Approach A, the satellite provider may follow one of two paths, depending on the fluid contained and the failure mode of the vessel. Table 4 summarizes most of the applicable sections for pressure systems and pressure vessels, the following discussion summarizes the verification requirements for several types of metallic pressure vessels and reservoirs. The discussion leaves out Composite Overwrapped Pressure Vessels (COPV) and as well as vessels that qualify for Verification Approach B. Many aspects of this discussion are summarized in Figure 6 and in Table 5. Metallic Pressure Vessels Verification Approach A Path 1 Table 5 summarizes the verification requirements for metallic pressure vessels that meet the criteria for Approach A Path 1 because they exhibit a LBB failure mode and a leakage of the contents cannot create a hazardous situation. If the CubeSat provider chooses, they may follow Path 2 instead (AFSPCMAN Vol. 3, 2004). The requirements begin with a demonstration of the failure mode in order to verify that the pressure vessel meets the criteria to follow Path 1. Among the other analysis and testing that is required at the design level, the satellite provider calculates Factor of Safety and determines the loads and environments that will exist throughout Range operations. When following Path 1, the CubeSat provider may use a conventional design methodology to calculate the Factor of Safety (AFSPCMAN Vol. 3, 2004). Qualification testing, which includes a burst test, subjects a dedicated pressure vessel to destructive test levels. In fact, the burst test always renders the test article unusable. According to Section , with approval, one-of-a-kind pressure vessels may choose to test their flight article at proto-qualification levels instead of dedicating a vessel to destructive qualification testing (AFSPCMAN Vol. 3, 2004). Acceptance test and inspection, which includes Non-Destructive Examination (NDE) and a proof test, are conducted at lower levels than either qualification testing or proto-qualification 48

73 testing. The tests and inspections are designed to identify any problems due to workmanship on the flight article (AFSPCMAN Vol. 3, 2004). Table 5: Verification requirements for metallic pressure vessels following Verification Approach A Path 1, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004). Phase Section(s) Verification Requirement(s) Design Demonstrate LBB failure mode (analytically or by test) Factor of Safety and proof factor by conventional design Minimum burst factor and and Stress Analysis Fatigue-Life Demonstration Loads and Environments Determination Qualification General Qualification Requirements Proto-Qualification Alternative to Qual. (Needs Approval) Acceptance Random Vibration Pressure Testing (Burst) and and , , and and Proof at 1.5 x MEOP and conventional fatigue analysis showing a minimum of 10 design lifetimes. General Acceptance Requirements Nondestructive Inspection Proof Test 49

74 Metallic Pressure Vessels Verification Approach A Path 2 Table 6 summarizes the verification requirements for metallic pressure vessels that meet the criteria for Approach A Path 2 because they exhibit a brittle failure mode or a leakage of the contents could create a hazardous situation. While the CubeSat provider may choose to follow Path 2 when they qualify for Path 1, they may not follow Path 1 in place of Path 2 unless they meet the requirements of Path 1 (AFSPCMAN Vol. 3, 2004). Many aspects of Path 2 are similar to Path 1. In some cases, the required analysis methods differ. On other cases the parameters of the analyses or tests differ. For Path 2, there is no need to verify the failure mode because the CubeSat provider may choose follow Path 2 regardless of the failure mode. For this reason, a CubeSat provider may choose to follow Path 2 if they decide that the cost of determining the failure mode is not worth the benefits of following Path 1. Among the other analysis and testing that is required at the design level, the satellite provider calculates Factor of Safety and determines the loads and environments that will exist throughout Range operations. When following Path 2, the CubeSat provider must use the safe-life design methodology to calculate the Factor of Safety (AFSPCMAN Vol. 3, 2004). Qualification testing, which includes a burst test, subjects a dedicated pressure vessel to destructive levels. In fact, the burst test always renders the test article unusable. According to Section , one-of-a-kind pressure vessels may choose to test their flight article at protoqualification levels instead of dedicating a vessel to destructive qualification testing (AFSPCMAN Vol. 3, 2004). Acceptance test and inspection, which includes Non-Destructive Examination (NDE) and a proof test, are conducted at lower levels than either qualification testing or proto-qualification testing. The tests and inspections are designed to identify any problems due to workmanship on the flight article (AFSPCMAN Vol. 3, 2004). 50

75 While section calls for a Burst Factor no less than 1.5, CubeSat pressure vessels that meet the criteria for Path 2 are also subject to a requirement given in AFPSCMAN Vol. 6 Section which requires a safety factor of 2 during transport or ground handling operations. Since CubeSats cannot load propellant on the pad, this requirement applies to all CubeSat pressure vessels that exhibit brittle failure or contain a hazardous fluid (AFSPCMAN Vol. 6, 2004). Table 6: Verification requirements for metallic pressure vessels following Verification Approach A Path 2, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004). Phase Section(s) Verification Requirement(s) Design Safe-life design methodology used to establish the factor of safety and proof factor. Qualification (Same as Path 1) Proto-Qualification Alternative to Qual. (Needs Approval) Vol and and Burst Safety Factor of 2 required during transport of ground handling operations. Safe-Life Demonstration Stress Analysis Loads and Environments Determination per General Qualification Requirements Random Vibration Pressure Testing (Burst) and Proof at 1.5 x MEOP and conventional fatigue analysis showing a minimum of 10 design lifetimes. Acceptance Based on Path 1: General Acceptance Requirements Nondestructive Inspection Proof Test 51

76 Sealed Container Non-Hazardous LBB Some low-pressure propellant reservoirs may be more accurately treated as sealed containers rather than pressure vessels. AFSPCMAN s requirements, which pertain to sealed containers, are intended to catch pressurized or sealed components which are not strictly pressure vessels. For example, components such as battery cases and electrical boxes may be considered sealed containers. However, when the propellant can be stored at a low enough pressure, Range Safety might treat propellant reservoirs more like sealed containers than pressure vessels (Case, Case Study Meeting, 2013b). As outlined in AFSCPMAN Vol. 3 Section , and summarized in Table 7, if a reservoir may be classified as a sealed container and exhibits a LBB failure mode where leakage of the contents cannot create a hazardous situation, the satellite provider may enjoy reduced verification requirements compared with the verification requirements for LBB nonhazardous pressure vessels (Path 1). On the other hand, according to AFSCPMAN Vol. 3 Section , a sealed container exhibiting a brittle fracture failure mode or containing a hazardous fluid, is required to follow the verification requirements of Section for Path 2 pressure vessels. Therefore, the verification requirements are only lightened for LBB nonhazardous sealed containers (AFSPCMAN Vol. 3, 2004). The section of Chapter VI titled Case 7: Electrospray, Gallium offers an example of a propellant reservoir which may be treated as a sealed container. In this example, however, the propellant is hazardous so the container would still be held to the requirements of a pressure vessel which contains a hazardous propellant. 52

77 Table 7: Verification requirements for Sealed Containers following Verification Approach A Path 1, as given in AFSPCMAN Vol. 3, especially Section (AFSPCMAN Vol. 3, 2004). Phase Section(s) Verification Requirement(s) Design (Required by ) Demonstrate LBB failure mode (analytically or by test). See possible exception described in Minimum burst factor 1.5 Qualification Pressure testing Acceptance Proof-pressure test to a minimum level of 1.25 x maximum design pressure differential or MAWP Recertification and Refurbishment AFSPCMAN Vol. 6 Section discusses requirements for periodic recertification of components, such as hoses for example, during ground operations (AFSPCMAN Vol. 6, 2004). Similar requirements appear in Vol. 3 Section , , and (AFSPCMAN Vol. 3, 2004). Access to the CubeSat is impossible after integration. CubeSat designers would need to work with Range Safety to arrive at an acceptable level of safety. If, however, a CubeSat were to use components that had been stored for long periods of time prior to integration, they may need to consult these requirements. Implementation Depending on the propellant, some propulsion systems may require as many as three independent inhibits which prevent fluid from leaking. This could affect the mass budget for the CubeSat, however, there are some compact ways to implement multiple inhibits. Chapter VI RANGE SAFETY CASE STUDIES contains many examples of propulsion system architectures. The reader is encouraged to explore each case that is discussed. 53

78 Structural Failure Not Considered Single Point of Failure First, it is important to note, according to AFSPCMAN Vol. 3 Section , that structural failure of tubing, piping, or pressure vessels is not to be considered single failure (AFSPCMAN Vol. 3, 2004). A properly designed pressure vessel can sufficiently contain a hazardous fluid. The ports, however, may require multiple independent inhibits, such as valve seals, to keep the propellant from leaking. Dual Seat Valves A dual seat valve can provide two independent inhibits by impeding fluid flow across two independent seals. While one control would be used to open both seals, that control could be sufficiently protected by a dual-fault tolerant circuit that prevents electrical power from reaching the actuator. The designer should be careful that the materials used allow for a good seal for both seats in the expected environmental extremes. For example, the developer should ensure that thermal expansion of one seal could not prevent the second seal from closing. Poppet and Cap Fill/Drain Interfaces In the fill / drain port, a designer may use a poppet and cap system to provide two independent inhibits. The poppet provides one seal to prevent fluid from flowing. If the cap is sealed, it can provide the second seal. During propellant loading operations, however, the cap is removed. Depending on the material, personnel may be required to wear Self Contained Atmospheric Protective Ensemble (SCAPE) suits during propellant loading operations. Omitted Sections from AFSPCMAN Certain requirements given in AFSPCMAN do not apply to CubeSat propulsion systems. For example, AFSPCMAN Vol. 3 Section discusses requirements for vent lines for flammable and combustible vapors (AFSPCMAN Vol. 3, 2004). CubeSats, however would not be allowed to vent. Neither could a vent line be run from the CubeSat without a P-POD redesign. 54

79 Other sections require access to the pressure system during ground operations. This, again, is not possible without a P-POD redesign. This may rule out hypergolic systems and very likely rules out cryogenic systems. It would be a challenging to prepare a CubeSat to fly with a monopropellant system. Hypergolic systems are a step farther than monopropellant systems in every hazard category. Cryogenic systems require a significant amount of maintenance that is not possible within the CubeSat specification. Cal Poly does not wish to limit progress in the CubeSat community. If a CubeSat developer believes they can find ways to safely implement hyperbolic or cryogenic systems, they should contact Cal Poly. For reference, Table 8 lists the sections of AFSPCMAN Vol. 3 which pertain to hypergolic and cryogenic systems. Table 8: Applicability of AFSPCMAN Vol. 3 requirements for some specific pressure system types (system level) (AFSPCMAN Vol. 3, 2004). Section(s) Criteria for Applicability Hypergolic propellant systems Cryogenic systems 55

80 VI. RANGE SAFETY CASE STUDIES This section presents a collection of hypothetical top-level CubeSat Propulsion system designs. Each design has been evaluated, ad hoc, with support from Range Safety, to determine an acceptable path toward qualification. None of the designs are intended to be complete, ideal, nor are they guaranteed to be feasible. The designs are hypothetical pathfinders intended to help CubeSat developers grasp how their particular system may be treated until their specific design can be reviewed by Range Safety. The systems are based on the spectrum of designs the author would expect to see in a CubeSat developer s trade space. If it were possible, one would prefer to draw a line between hazardous systems and nonhazardous systems. However, the complexity and diversity of space hardware and propulsion systems prevent such a distinction from being drawn definitively. AFSPCMAN distinguishes between hazardous and non-hazardous materials, but there is no clear line drawn between the two. Neither is there a clear cut quantity at which materials become hazardous. Each design and each environment brings unique nuances and effective interpretation of safety requirements requires technical experience. That is why the hypothetical designs in this study were presented to Range Safety. Range Safety Engineer Kevin Case, who currently provides Range Safety support for CubeSat missions flying from the Western Range, reviewed each design and gave initial recommendations based on his expertise. Each design serves as a pathfinder. While each case cannot be taken as a template, they will help the CubeSat developer to estimate the approximate level of analysis and testing they will need to conduct and the number of inhibits their system may need to include. Rationale is given throughout the discussions so that the reader can better predict how their particular system may be regarded by Range Safety. After reading this discussion, the CubeSat developer should be better prepared to estimate the magnitude of work required to qualify their propulsion system. From there the CubeSat developer can better estimate the cost of their system. The developer will also 56

81 understand the path to qualification and where to begin. This discussion should help the CubeSat developer to better navigate their trade space by providing a substantive estimate of the work required to qualify competing propulsive designs. Many topics of this study also apply for nonpropulsive designs. For example, a CubeSat developer will benefit from reading this discussion if their system contains a pressure vessel or hazardous materials. The toxicology and other hazardous qualities that are discussed in this document should help to alert the reader to certain hazards. However, this document is not an adequate substitute to the Material Safety Data Sheets (MSDS) or the Safety Data Sheets (SDS). Those documents must be studies before work with these materials can begin. In no way is this discussion intended to be a complete guide to the hazards associated with these hypothetical systems. Table 9: Summary of Hypothetical Cases. Propulsion Type Propellant Comments Case # Hydrazine Very hazardous propellant 1 Monopropellant Hydrogen Peroxide Hazardous propellant 2 AF-M315E (Liquid HAN Solution) Green propellant 3 Cold Gas Gaseous Nitrogen Inert propellant, low I sp 4 Resistojet R-134a Two-phase propellant allows for dense propellant storage at low pressures. 5 Electrospray Ionic Fluid such as EMI-BF4 Liquid Metal Gallium Porous fluid containment system Gallium is very corrosive to Aluminum. 6 7 Ion Thruster Xenon Inert propellant, high I sp 8 Pulsed Plasma Thruster (PPT) Teflon Inert solid propellant 9 57

82 Summary of Cases Table 9 summarizes each case that will be discussed. Clearly this list is not all-inclusive. However, the CubeSat developer should be able to sample the concerns that are discussed in each case in order to predict how their system will be treated by Range Safety. The case study originally included multiple propellant quantities for the monopropellant options. However, more research would be needed to demonstrate a decrease in hazard severity with lower propellant quantities. Since no distinction could be made between large amounts of propellant, the various propellant masses were consolidated into one. For each case the hazards associated with that hypothetical system are discussed. The hazard severity and fault tolerance requirement is estimated according to the criteria discussed in the section titled Hazard Severity and Fault Tolerance in Chapter IV of this document. In response to the fault tolerance requirements, inhibits are proposed according to the guidelines discussed in the section titled Inhibits in Chapter IV of this document. The sections described above repeatedly reference AFSPCMAN Vol. 1 and Vol. 3. The Range Safety requirements, as discussed in Chapter V of this document, are applied to each system, with an emphasis on determining the pressure system verification requirements. Case 1: Monopropellant, Hydrazine A monopropellant propulsion system operates by exposing a liquid propellant to a catalyst bed. The catalyst bed supports rapid exothermic decomposition which produces a high pressure gas. The gas is expanded and accelerated through a nozzle and propelled away from the spacecraft. The momentum exchange from acceleration of the exhaust results in thrust. Monopropellant systems generate a significant amount of interest due to their promise of relatively high I sp compared with some other micropropulsion options. While monopropellant systems do not offer the same mass efficiency as bipropellant systems, they are free from many risks associated with hypergolic and cryogenic propellants. Monopropellant systems are also less 58

83 complex compared with bipropellant systems. Still, they harbor many potential hazards that must be addressed. This hypothetical monopropellant propulsion system uses an Iridium catalyst bed to decompose hydrazine (N 2 H 4 ) propellant. The Iridium catalyst bed will decompose the hydrazine propellant at room temperature (Sutton & Biblarz, 2010, p. 259). The resulting exhaust gas is accelerated through a nozzle to create thrust. Aerojet markets such a system (Aerojet Rocketdyne, 2013). Hazard overview Hydrazine is known as a very hazardous material. According to the Material Safety Data Sheet (MSDS), severe over-exposure can result in death. Hydrazine is a very hazardous irritant in cases of skin contact and very hazardous to ingest. It can also cause corrosion upon skin contact and irritation upon eye contact. Hydrazine can be hazardous upon inhalation and it may react violently with water to emit toxic gases. Hydrazine can permeate the skin (Hydrazine MSDS, 2013). Hydrazine can participate in very energetic reactions. This is one quality that makes it an excellent monopropellant and bipropellant. However, the performance comes with very serious potential hazards. According to the MSDS, hydrazine is extremely explosive in presence of oxidizing materials and highly explosive in presence of metals (Hydrazine MSDS, 2013). Table 11 summarizes the hazards for this case. Hydrazine is very toxic and capable of participating in energetic reactions. Either of these hazards may cause death, or significantly impact the mission timeline. Therefore, hydrazine must be contained with dual-fault tolerance to protect against a catastrophic hazard. 59

84 Table 10: Monopropellant Hydrazine Case, Hypothetical System Parameters. Propulsion System Type: Monopropellant Propellant: Hydrazine (N 2 H 4 ) Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: 1 kg Iridium Catalyst Bed 200 psig Single-tank blow-down Metallic Pressure Vessel Figure 7: Monopropellant Hydrazine Case, Hypothetical System Schematic. Table 11: Monopropellant Hydrazine Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Toxic Propellant Exposure Catastrophic May cause death Toxic Plume Exposure Potentially Catastrophic May cause death Energetic Plume Potentially Catastrophic May cause death or serious damage to critical hardware 60

85 Inhibits Table 12: Hydrazine Monopropellant Case, Hypothetical Inhibits. Hazard Toxic Propellant Exposure through Fill / Drain Valve 1. Latch Valve Inhibits 2. Valve with Poppet Seal 3. Cap Toxic Exposure through Nozzle 1. Dual seat valve (seal #1) 2. Dual seat valve (seal #2) 3. Thruster valve ~ Some decomposition at catalyst bed Energetic Plume 1. Dual seat valve (seal #1) 2. Dual seat valve (seal #2) 3. Thruster valve During processing at the range, hydrazine leak detection sensors will likely be used. However, it is important to understand that after integration to the P-POD and certainly after P- POD integration to the launch vehicle, the CubeSat provider will not have access to their spacecraft in order to stop a leak. If a leak were to occur it is likely that the CubeSat would be deintegrated, resulting in a significant impact to the mission. Fill / Drain Connection The Fill / Drain port uses three inhibits to prevent propellant leakage; 1) one latch valve, 2) one Fill / Drain valve with a poppet, and 3) the sealing cap which fits over the Fill / Drain valve. These three seals protect personnel during most operations. During propellant loading operations, however, the cap is removed. For this reason, all personnel must wear Self Contained Atmospheric Protective Ensemble (SCAPE) suits during propellant loading operations. 61

86 Propellant Leakage through the Nozzle Propellant is prevented from leaking through the nozzle by three inhibits. The Dual Seat Latch valve provides two independent inhibits by impeding fluid flow across two independent seals. While one control would be used to open both seals, that control is sufficiently protected by a dual-fault tolerant circuit that prevents electrical power from reaching the actuator. The third inhibit is a single-seat Thruster Valve that is normally used to control the thruster during operations. The catalyst bed offers a fourth soft inhibit which would decrease the severity of toxic exposure in the case that propellant reaches the nozzle. The CubeSat developer may wish to save resources or complexity by removing a valve seal between the pressure vessel and the nozzle by counting the catalyst bed as an inhibit which prevents the hazardous propellant from leaking through the nozzle. This scenario is equivalent to a premature firing. The developer in that case must convince Range Safety that the catalyst operates efficiently enough such that a feasible amount of exhaust would not contain catastrophic concentrations of unreacted propellant or any toxic products of reaction. Furthermore, the developer would need to demonstrate that the maximum feasible amount of energy released during the decomposition reaction could not cause a catastrophic situation. (Case, Case Study Meeting, 2013b) If any propellant exists between the catalyst bed and the Thruster Valve, or between the Thruster Valve and the Latch Valve, the quantity would not likely present a catastrophic hazard in the event of leakage. Capillary forces should keep the propellant from leaking and the catalyst would help to passivate some of the propellant (Case, Case Study Meeting, 2013b). Premature Firing Premature firing may cause a catastrophic hazard by inducing a fire, explosion, etc. In this study, we assume that is the case. Even with the catalyst aiding decomposition, the propellant may not decompose completely and some of the hazardous propellant may remain in the exhaust. 62

87 As with propellant leakage, premature firing is inhibited by the Dual Seat Latch Valve and the Thruster Valve. The CubeSat developer may be able to demonstrate that the energy released during the worst-case feasible premature firing could not cause death or significantly impact the primary mission. If that were the case, the CubeSat developer could protect against premature firing with only single-fault tolerance. Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 2 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Regardless of the failure mode of the pressure vessel, it would be subject to Verification Approach A, Path 2 due to the hazardous nature of the propellant. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 2 in Chapter V. In summary, the CubeSat provider would be subject to stress analysis, a Fracture Mechanics Safe- Life Demonstration (analysis or test), a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level determined by Fracture Mechanics Safe-Life analysis with a minimum of 1.25 x MEOP (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Cycle tests at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 2: Monopropellant, Hydrogen Peroxide This monopropellant propulsion system uses a catalyst bed to decompose hydrogen peroxide (H 2 O 2 ). The resulting exhaust gas is accelerated through a nozzle to generate thrust. Hydrogen peroxide is sometimes regarded as a green propellant because it carries less hazard 63

88 compared to propellants such as hydrazine. However, hydrogen peroxide does present some serious hazards that must be addressed. The next case, Case 3, will discuss another green propellant which carries less hazard than hydrogen peroxide. Case 2 resembles the monopropellant hydrazine system in Case 1 in many ways. However, some scenarios which are catastrophic for hydrazine become critical for hydrogen peroxide. This decrease in hazard severity generally allows for the elimination of one inhibit for each leakage mode. Hydrogen peroxide does present a new hazard of decomposition and thermal runaway during storage. Hazard Overview Concentrated hydrogen peroxide causes severe burns when in contact with human skin and may ignite and cause fires when in contact with wood, oils, and many other organic materials (Sutton & Biblarz, 2010, p. 258). Under high concentrations, hydrogen peroxide constitutes at least a critical hazard due to its toxicity which requires a single-fault tolerant design to prevent leakage of the propellant. The energy that would be released during a premature firing could constitute a critical hazard, depending on the potential for energy release. Hydrogen peroxide is instable in storage, able to decompose with many contaminants acting as a catalyst. Care must be taken to avoid reaching temperatures near 448 K where hydrogen peroxide may explode (Sutton & Biblarz, 2010). Thermal runaway due to decomposition could cause serious pressure buildup. A pressure vessel burst could constitute a catastrophic hazard. The material s instability during storage may present a significant risk for CubeSat propulsion systems which must remain inside the P-POD for extended periods of time before launch. In fact, a CubeSat may be required to sustain extended storage when a launch is postponed due to launch vehicle failures on other missions, a missed launch window, etc. 64

89 Table 13: Monopropellant Hydrogen Peroxide Case, Hypothetical System Parameters. Propulsion System Type: Monopropellant Propellant: Hydrogen Peroxide (H 2 O 2 ) Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: 1 kg Catalyst Bed 350 psig (Green Propellant Rockets, n.d.) Single-tank blow-down Metallic Pressure Vessel Figure 8: Monopropellant Hydrogen Peroxide Case, Hypothetical System Schematic. Table 14: Monopropellant Hydrogen Peroxide Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Toxic Propellant Exposure Critical Severe burns Energetic Plume Thermal Runaway Decomposition and Burst Critical or Marginal (Potentially Catastrophic) Critical or Catastrophic Injury / Damage to Launch Vehicle May cause death or impact mission significantly, depending on energy release 65

90 Inhibits Table 15: Monopropellant Hydrogen Peroxide Case, Hypothetical Inhibits. Hazard Toxic Propellant Exposure through Fill / Drain Valve Inhibits 1. Valve with Poppet Seal 2. Cap Toxic Exposure through Nozzle 1. Latch valve 2. Thruster valve ~ Some decomposition at catalyst bed (May not be needed, but improves safety) Energetic Plume 1. Latch valve 2. Thruster valve Fill / Drain Connection The Fill / Drain port uses two inhibits to prevent propellant leakage; 1) one Fill / Drain valve with a poppet, and 2) the sealing cap which fits over the Fill / Drain valve. These two seals protect personnel during most operations. During propellant loading operations, however, the cap is removed. For this reason, all personnel must wear Self Contained Atmospheric Protective Ensemble (SCAPE) suits during propellant loading operations. Propellant Leakage through the Nozzle Propellant is prevented from leaking through the nozzle by two inhibits and one soft inhibit. The Latch Valve provides one inhibit by impeding fluid flow across its seal. The Thruster Valve that is normally used to control the thruster during operations provides the second inhibit. The catalyst bed offers a third soft inhibit which would decrease the severity of toxic exposure in the case that propellant reaches the nozzle. The CubeSat developer may wish to save resources or complexity by removing one of the valves between the pressure vessel and the nozzle by counting the catalyst bed as an inhibit which 66

91 prevents the hazardous propellant from leaking through the nozzle. This scenario is equivalent to a premature firing. The developer in that case must convince Range Safety that the catalyst operates efficiently enough such that a feasible amount of exhaust would not contain critical concentrations of unreacted propellant or any toxic products of reaction. Furthermore, the developer would need to demonstrate that the maximum feasible amount of energy released during the decomposition reaction could not cause a critical situation. (Case, Case Study Meeting, 2013b) If any propellant exists between the catalyst bed and the Thruster Valve, or between the Thruster Valve and the Latch Valve, the quantity would not likely present a critical hazard in the event of leakage. Capillary forces should keep the propellant from leaking and the catalyst would help to passivate some of the propellant (Case, Case Study Meeting, 2013b). Premature Firing Premature firing may cause a catastrophic hazard by inducing a fire, explosion, etc. Additionally, even with the catalyst aiding decomposition, the propellant may not decompose completely and some of the hazardous propellant may remain in the exhaust. Furthermore, the exhaust fumes themselves may present a hazard. As with propellant leakage, premature firing is inhibited by the Latch Valve and the Thruster Valve. Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 2 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Regardless of the failure mode of the pressure vessel, it would be subject to Verification Approach A, Path 2 due to the hazardous nature of the propellant. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 2 in Chapter V. In summary, the CubeSat provider would be subject to stress analysis, a Fracture Mechanics Safe- 67

92 Life Demonstration (analysis or test), a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level determined by Fracture Mechanics Safe-Life analysis with a minimum of 1.25 x MEOP (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Cycle tests at qualification levels, Burst test, and Nondestructive Examination (NDE). Thermal runaway and gradual decomposition must be taken into consideration in the design of the pressure system. There may be a pressure at which the propellant will no longer decompose during storage. This maximum feasible pressure should be used as the Maximum Expected Operating Pressure (MEOP) for the vessel to ensure that decomposition during storage cannot cause the tank to burst, potentially creating a catastrophic hazard. Such analysis was not done in this simple case study, but should be addressed by any developer who wishes to implement a hydrogen peroxide monopropellant system. Case 3: Monopropellant, AF-M315E (Aqueous HAN Solution) This monopropellant propulsion system uses a catalyst bed to decompose AF-M315E. The resulting exhaust gas is accelerated through a nozzle to create thrust. Aerojet markets such systems (Aerojet Rocketdyne, 2013). AF-315E is an aqueous solution of hydroxyl ammonium nitrate (HAN), developed by Aerojet (Miket, 2013). The propellant is marketed as a green propellant which lends itself as a monopropellant. 68

93 Table 16: Monopropellant AF-315E Case, Hypothetical System Parameters. Propulsion System Type: Propellant: Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: Vessel Failure Mode: Monopropellant AF-315E (Aqueous HAN) 1 kg Catalyst Bed Unknown Single-tank blow-down Metallic Pressure Vessel Leak-before-burst (LBB) Figure 9: Monopropellant AF-315E Case, Hypothetical System Schematic. Table 17: Monopropellant AF-315E Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Toxic Propellant Exposure Marginal Severe burns Energetic Plume Critical or Marginal (Potentially Catastrophic) Injury / Damage to Launch Vehicle 69

94 Hazard Overview Largely, AF-315E is safe in comparison with hydrogen peroxide, and especially hydrazine. Dermal exposure can cause irritation or a rash in the form of dermatitis, but the material can be washed off. As long as the propellant remains as an aqueous solution, there is no inhalation hazard. The vapor pressure of the water greatly diminishes the vapor pressure of the HAN. If the material leaks, it can simply be mopped up. When dried out of solution, HAN exists as a salt and has no vapor pressure. Toxic poising can occur if the material is ingested, which may lead to vomiting. Any CubeSat developer considering the use of AF-M316E as a propellant should research the material further to identify, for example, whether the decomposition materials pose any risk (Case, Case Study Meeting, 2013b). The risk of poisoning due to ingestion can be avoided with sufficient training of personnel. All other hazards related to toxicity that are known to the author are marginal hazards. Inhibits Table 18: Monopropellant AF-315E Case, Hypothetical Inhibits. Hazard Toxic Propellant Exposure through Fill / Drain Valve Inhibits 1. Valve with Poppet Seal 2. Cap Toxic Exposure through Nozzle 1. Latch valve 2. Thruster valve ~ Some decomposition at catalyst bed (May not be needed, but improves safety) Energetic Plume 1. Latch valve 2. Thruster valve Fill / Drain Connection While only one inhibit may be needed to contain the marginal hazard, the Fill / Drain port naturally uses two inhibits to prevent propellant leakage; 1) one fill valve with a poppet, and 2) 70

95 the sealing cap which fits over the fill valve. These two seals protect personnel during most operations. Propellant Leakage through the Nozzle Propellant is prevented from leaking through the nozzle by two inhibits and one soft inhibit. The Latch Valve provides one inhibit by impeding fluid flow across its seal. The Thruster Valve that is normally used to control the thruster during operations provides the second inhibit. The catalyst bed offers a third soft inhibit which would decrease the severity of toxic exposure in the case that propellant reaches the nozzle. The CubeSat developer may wish to save resources or complexity by removing one of the valves between the pressure vessel and the nozzle by counting the catalyst bed as an inhibit which prevents the hazardous propellant from leaking through the nozzle. This scenario is equivalent to a premature firing. The developer in that case must convince Range Safety that any feasible amount of exhaust would not contain critical concentrations toxic products of reaction. Furthermore, the developer would need to demonstrate that the maximum feasible amount of energy released during the decomposition reaction could not cause a critical situation. (Case, Case Study Meeting, 2013b) Premature Firing Premature firing may cause a catastrophic hazard by inducing a fire, explosion, etc. The CubeSat developer would need to prove that the energy released during the worst-case feasible premature firing could not cause death or significantly impact the primary mission. In this study, we assume that is the case and treat premature firing as a critical hazard. As with propellant leakage, premature firing is inhibited by the Latch Valve and the Thruster Valve. Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 1.5 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Since 71

96 leakage of the propellant would not create a hazardous situation and the failure mode of the pressure vessel is Leak-before-burst (LBB), the pressure vessel is subject to Verification Approach A, Path 1. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 1 in Chapter V. The CubeSat developer would need to demonstrate the failure mode analytically or by test. If the failure mode turns out to be Brittle Fracture, then the developer would need to satisfy Verification Approach A, Path 2 instead and achieve a burst safety factor of 2. In summary, under Path 1, the CubeSat provider would be subject to stress analysis, a Fatigue-Life Demonstration, and a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level dependent of the Burst Factor (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 4: Cold Gas, Nitrogen Compared with monopropellant thrusters, cold gas thrusters do not rely on the release of chemical energy. Rather, cold gas thrusters rely solely on the release of stored physical energy. For this reason, cold gas propellants are often inert gases stored at very high pressures. This cold gas propulsion system accelerates pressurized gaseous Nitrogen (N 2 ) through a nozzle to generate thrust. At the quantities used on a CubeSat, gaseous Nitrogen is non-toxic. The pressure vessel stores the propellant under 5,000 psia in a 1U volume of 1 Liter. The pressure level is comparable to the range of pressures given in Rocket Propulsion Elements (Sutton & Biblarz, 2010, p. 266). Assuming a temperature of 20 C and using the ideal gas law, this would 72

97 correspond to approximately 0.4 kg of stored diatomic Nitrogen gas. The metallic pressure vessel in this hypothetical system is assumed to have a Leak-before-burst (LBB) failure mode. Hazard Overview For cold gas thrusters the primary hazard is generally the high pressure contained by the pressure system. The requirements to contain this hazard are very well defined by AFSPCMAN Vol.3 Ch. 12. While gaseous Nitrogen is not toxic in the quantities that would be present in a CubeSat system, it can displace oxygen in the air (Case, Case Study Meeting, 2013b). If all of the 0.4 kg of Nitrogen propellant were to be released at once, it could fill a volume of approximately 1/3 m 3 at standard atmospheric conditions. Therefore, care must be taken to ensure that the storage and work areas are adequately ventilated to prevent asphyxiation in case a leak occurs. As long as the hazard is dealt with appropriately, this hazard should not be a major deterrence. Liquid and gaseous Nitrogen are routinely used in large quantities for aerospace applications and many facilities are well equipped to deal with that hazard. If the jet through the nozzle is strong enough, contact could cause injury to personnel which constitutes a critical hazard. If that were the case, the system would need to be single-fault tolerant against premature firing. This would constitute a need for a second valve between the pressure vessel and the nozzle. The same would be true for the fill port. In the example given, the fill valve is already single-fault tolerant with two seals. 73

98 Table 19: Cold Gas Nitrogen Case, Hypothetical System Parameters. Propulsion System Type: Cold Gas Propellant: Gaseous Nitrogen (N 2 ) Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: Vessel Failure Mode: 0.4 kg None 5,000 psia (~340 atm) Single-tank blow-down Metallic Pressure Vessel Leak-before-burst (LBB) Figure 10: Cold Gas Nitrogen Case, Hypothetical System Schematic. Table 20: Cold Gas Nitrogen Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences High pressure jet Unknown Injury Displacement of oxygen in the air Catastrophic Could cause death by asphyxiation 74

99 Inhibits Table 21: Cold Gas Nitrogen Case, Hypothetical Inhibits. Hazard Inhibits High pressure jet through fill port 1. Valve with Poppet Seal 2. Cap High pressure jet through nozzle 1. Thruster valve High Pressure Jet through Fill / Drain Port Personnel exposure to a high pressure jet through the Fill / Drain Port is impeded by two inhibits; 1) one fill valve with a poppet, and 2) the sealing cap which fits over the fill valve. These two seals protect personnel during most operations. High Pressure Jet through Nozzle Personnel exposure to a high pressure jet through the nozzle is impeded by one inhibit; the thruster valve. As mentioned above, if this hazard constituted a critical hazard, the CubeSat developer would need to add one more valve between the pressure vessel and the nozzle. Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 1.5 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Since leakage of the propellant would not create a hazardous situation and the failure mode of the pressure vessel is Leak-before-burst (LBB), the pressure vessel is subject to Verification Approach A, Path 1. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 1 in Chapter V. The CubeSat developer would need to demonstrate the failure mode analytically or by test. If the failure mode turns out to be Brittle Fracture, then the developer would need to satisfy Verification Approach A, Path 2 instead and achieve a burst safety factor of 2. 75

100 In summary, under Path 1, the CubeSat provider would be subject to stress analysis, a Fatigue-Life Demonstration, and a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level dependent of the Burst Factor (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 5: Resistojet, R-134a Resistojet propulsion systems, also known as electrothermal propulsion systems, have attracted the interest of many. For obvious reasons, Resistojets are often referred to as cold gas thrusters with heaters, or even warm gas thrusters. They function similarly to cold gas thrusters by accelerating a propellant through a nozzle without a chemical reaction occurring. They also incorporate some similar advantages as chemical thrusters which take advantage of an exothermic reaction and chemical changes in the propellant to prepare a high-energy gas that accelerates through the nozzle. Resistojets, however, do not utilize chemical energy to energize their propellant. They use electrical energy to heat the propellant and drive physical changes. The propellant increases in temperature and pressure, and in the case of R-134a, changes from liquid to gas. The result is a higher energy gaseous propellant that can be accelerated through the nozzle. By using electrical energy to add energy to the propellant, resistojets offer a significant increase in propellant mass efficiency compared with cold gas thrusters, while preserving most of the simplicity in design that is characteristic of cold gas thrusters. From the perspective of Range Safety, it is better to add energy to the propellant on orbit with a heater rather than store the same energy in instable chemical bonds that may react during ground processing. 76

101 R-134a, and several other fluids that are commonly used as refrigerants, offer benefits as two-phase material. These materials undergo a phase change between liquid and gas near room temperature. This advantageous quality allows the fluid to be stored in a relatively dense liquid form, then vaporized by evaporation or with the help of heaters before being accelerated through the nozzle. This quality allows for relatively low pressure requirements for the propellant tanks, comparable with the vapor pressure of the fluid. The vapor pressure also allows the two-phase propellant to self-pressurize even for two-phase cold gas systems that do not use heaters. The hypothetical case given here is an resistojet thruster which uses an electric heater to raise the pressure of R-134a, thus converting it from a liquid to a gas. The heated and pressurized gas is then accelerated through a nozzle to generate thrust. Busek markets such a system, as does Vacco, Many of the assumptions of this study are loosely based upon the Busek datasheets so that this discussion may be helpful for developers who consider similar products (Busek Space Propulsion and Systems, 2013). Hazards Overview At the pressures given, R-134a is a condensed liquid. If it were to leak, it would evaporate under atmospheric conditions. According to the MSDS for R-134a, irritation would result from a defatting action on tissue and liquid contact could cause frostbite to the skin or to the eyes. Upon evaporation, the vapors could displace oxygen, leading to asphyxiation and at high levels, cardiac arrhythmia may occur (Material Safety Data Sheet R-134A, 2008). Since R-134a vapor can displace oxygen in the air, care must be taken to ensure that the storage and work areas are adequately ventilated to prevent suffocation in case a leak occurs. As long as the hazard is dealt with accordingly, this hazard should not be a major deterrence. 77

102 Table 22: Resistojet R-134a Case, Hypothetical System Parameters. Propulsion System Type: Resistojet (Electrothermal) Propellant: Gaseous Nitrogen (N 2 ) Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: Vessel Failure Mode: 0.3 kg Electric heater heats propellant 200 psia Single-tank blow-down Metallic Pressure Vessel Leak-before-burst (LBB) Figure 11: Resistojet R-134a Case, Hypothetical System Schematic. Table 23: Resistojet R-134a Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Propellant Leak Marginal May delay schedule, minor injury Premature Heating of Propellant and Firing Catastrophic Injury / Damage to Launch Vehicle 78

103 As with monopropellant systems, Resistojet exhaust plumes may be very hot, depending on the heating efficiency and the flow rate, among other factors. Furthermore, the MSDS claims that at high temperatures above 250 C, decomposition products may include Hydrofluoric Acid (HF) and carbonyl hilides (Material Safety Data Sheet R-134A, 2008). Therefore, premature firing will be treated as a catastrophic hazard. In addition to the hazards discussed above, the CubeSat provider should ensure that their system adequately protects against contamination of optical systems on the launch vehicle. Depending on the criticality of the optics, this hazard may vary. Inhibits Table 24: Resistojet R-134a Case, Hypothetical Inhibits. Hazard Inhibits Leakage through Fill / Drain Port 1. Valve with Poppet Seal 2. Cap Leakage through Nozzle 1. Thruster valve Premature heating of propellant and firing 1. Thruster valve 2. Electrical inhibit of heater power #1 3. Electrical inhibit of heater power #2 Propellant Leak through Fill / Drain Port Propellant leakage through the Fill / Drain Valve is impeded by two inhibits; 1) one fill valve with a poppet, and 2) the sealing cap which fits over the fill valve. These two seals protect personnel during most operations. 79

104 Propellant Leak through Nozzle Propellant leakage through the nozzle is impeded by one inhibit; the thruster valve. As mentioned above, if this hazard constitute a critical hazard, the CubeSat developer would need to add one more valve between the pressure vessel and the nozzle. Premature Heating of the Propellant and Firing Premature heating of the propellant is impeded by one physical inhibit and two electrical inhibit. The thruster valve prevents propellant from reaching the heater while two independent electrical inhibits prevent electrical power turning on the heater. In total, these three inhibits should sufficiently contain even a catastrophic hazard associated with heating the propellant. Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 1.5 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Since leakage of the propellant would not create a hazardous situation and the failure mode of the pressure vessel is Leak-before-burst (LBB), the pressure vessel is subject to Verification Approach A, Path 1. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 1 in Chapter V. The CubeSat developer would need to demonstrate the failure mode analytically or by test. If the failure mode turns out to be Brittle Fracture, then the developer would need to satisfy Verification Approach A, Path 2 instead and achieve a burst safety factor of 2. In summary, under Path 1, the CubeSat provider would be subject to stress analysis, a Fatigue-Life Demonstration, and a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level dependent of the Burst Factor (AFSPCMAN Vol. 3, 2004). A qualification model would undergo 80

105 Random vibration testing at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 6: Electrospray, Ionic fluid Electrospray propulsion systems use electric power to accelerate an ionic fluid propellant to produce thrust. Busek markets such a system which uses a system of valves and conduits to manage the propellant (Busek Electrospray Thrusters, 2013). However, this example will resemble a system with a somewhat more exotic propellant containment approach that MIT has developed. This system uses capillary forces to contain the propellant within a porous substrate (ion Electrospray Propulsion System for CubeSats (ieps), 2013). Busek claims that its ionic fluid offers a low vapor pressure which makes for light requirements on the propellant reservoir. They also claim that their propellant is safe, non-toxic, non-volatile (Busek Electrospray Thrusters, 2013). This claim cannot be independently verified because Busek does not publish what propellant they use. However, those qualities are generally true of the ionic fluid EMI-BF4, which is commonly used in electrospray applications. For such a safe propellant with a low vapor pressure, the reservoir and valve system may only be needed for containment of the fluid rather than for protection against a hazard (Case, Case Study Meeting, 2013b). MIT is developing an electrospray propulsion system which uses capillary forces to contain the propellant with a porous substrate. They claim that the propellant does not need to be pressurized and flows exclusively by capillarity forces. The lack of valves, pipes, pumps and pressurization enables very compact designs, compatible with CubeSat limitations and requirements (ion Electrospray Propulsion System for CubeSats (ieps), 2013). 81

106 Table 25: Electrospray Ionic Fluid Case, Hypothetical System Parameters. Propulsion System Type: Propellant: Propellant Mass: Ignition Method: Propellant Storage: Electrospray Ionic Fluid such as EMI-BF kg Electric acceleration of ionic propellant Capillary forces of a porous substrate Table 26: Electrospray Ionic Fluid Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Electric discharge Catastrophic Shock, EMI Propellant Exposure Potentially critical Skin irritation Overview of Hazards While generalizations cannot be made for all ionic liquids, EMI-BF4 is not very toxic. The MSDS claims that the fluid could be harmful if absorbed through the skin and it may cause skin irritation (Material Safety Data Sheet: 1-ethyl-3-methylimidazolium tetrafluoroborate, 2012). This situation may become critical, especially due to lost time in the primary mission schedule (Case, Case Study Meeting, 2013b). One important mode of failure would be dripping or spillage due to premature operation of the thruster. Since the propellant conducts well, this could lead to electrical shorts. Proper fault tolerance would be necessary to prevent electrical power from reaching the thruster. The thruster that MIT is developing operates at a 1000 V (ion Electrospray Propulsion System for CubeSats (ieps), 2013). Electric discharge may cause an electromagnetic interference (EMI) or shock hazard. Electric discharge may also initiate a fire if it occurs in an incendiary environment created by external factors such as Launch Vehicle propellant loading operations. Three inhibits may be required to prevent electric power from reaching the thruster. 82

107 Inhibits Table 27: Electrospray Ionic Fluid Case, Hypothetical Inhibits. Hazard Inhibits Premature electric discharge 1. Power source inhibit 2. Power control inhibit #1 3. Power control inhibit #2 The hazards associated with premature operation and electric discharge are contained with three inhibits. One inhibit impedes power flow to the satellite while two more control switches prevent power from reaching the thruster. Propellant Containment As discussed earlier, the propellant of this hypothetical thruster is contained by capillary forces by a porous material. Analysis and testing would be required to demonstrate that the capillary force for the largest pore size is sufficient to overpower accelerations introduced by gravity, launch vibrations, qualification-level vibrations, and the shock environment, across the maximum and minimum expected temperatures. Case 7: Electrospray, Gallium This electrospray propulsion system uses electric power to accelerate liquid Gallium propellant to produce thrust. Gallium is solid at room temperature, but it melts at temperatures as low as the human body temperature. Functionally, to prevent liquid Gallium from freezing and causing a leak in a valve during the mission, all components would need to be heated. Due to the corrosion hazards associated with Gallium, a CubeSat provider would need to supply a very convincing argument to justify its use on a CubeSat. 83

108 Table 28: Gallium Ionic Fluid Case, Hypothetical System Parameters. Propulsion System Type: Propellant: Propellant Mass: Ignition Method: Propellant Storage: Electrospray Gallium kg Electric acceleration of ionic propellant Heated Sealed Container Figure 12: Gallium Ionic Fluid Case, Hypothetical System Schematic. Table 29: Gallium Ionic Fluid Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Electric discharge Catastrophic Shock, EMI Exposure of Gallium to Aluminum Catastrophic Corrosion 84

109 Hazards Overview While Gallium is non-toxic, it is highly corrosive to Aluminum. Therefore, leakage of the propellant could cause a catastrophic hazard to the launch vehicle. Such a system would need to be isolated from any Aluminum parts by three inhibits. The thruster plume may also be corrosive to the launch vehicle. Before integration to the P-POD, and before delivery to the launch site, all traces of Gallium must be removed from the exterior of the satellite and from any part of the satellite where it does not need to be. Electric discharge may present electromagnetic interference (EMI) or shock hazards. Electric discharge may initiate a fire if it occurs in an incendiary environment created by external factors such as Launch Vehicle propellant loading operations. Three inhibits may be requried to prevent electric power from reaching the thruster. Inhibits Table 30: Gallium Ionic Fluid Case, Hypothetical Inhibits. Hazard Exposure of Gallium to Aluminum Parts through Fill / Drain Valve Inhibits 1. Heated Latch Valve 2. Heated Valve with Poppet Seal 3. Heated Cap Exposure of Gallium to Aluminum Parts through Thruster 1. Heated Dual seat valve (seal #1) 2. Heated Dual seat valve (seal #2) 3. Non-explosive pyro valve Premature electric discharge 1. Power source inhibit 2. Power control inhibit #1 3. Power control inhibit #2 85

110 Fill / Drain Connection The Fill / Drain port uses three inhibits to prevent propellant leakage; 1) one latch valve, 2) one Fill / Drain valve with a poppet, and 3) the sealing cap which fits over the Fill / Drain valve. During propellant loading operations, the valves would need to be heated to prevent the Gallium from freezing and causing leaks across the valve seals. Leakage through the Thruster Leakage through the thruster is impeded by three inhibits. A dual seat latch valve with single-fault tolerant controls prevents the propellant from migrating past its two seals. A nonexplosive pyro valve is also used here to impede migration of the propellant to the thruster. These valves and the conduits connecting them would need to be heated during operations and during any flow tests. Care must be taken to ensure that molten Gallium cannot leak through the thruster. The conduits may need to be completely free of propellant. Premature Electric Discharge The hazards associated with premature operation and electric discharge are contained with three inhibits. One inhibit impedes power flow to the satellite while two more control switches prevent power from reaching the thruster. Propellant Containment The low vapor pressure of Gallium does not necessarily call for the use of a pressure vessel. However, the propellant containment system must be sealed. Therefore, the propellant reservoir will likely be treated as a sealed container. The metallic sealed container which contains a hazardous material would be subject to a burst safety factor of 2 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Since leakage of the propellant could create a hazardous situation, the sealed container is subject to the same requirements as a pressure vessel carrying a hazardous material. This verification approach is described in the discussion titled Metallic Pressure Vessels 86

111 Verification Approach A Path 2 in Chapter V. In summary, the CubeSat provider would be subject to stress analysis, a Fracture Mechanics Safe-Life Demonstration (analysis or test), a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level determined by Fracture Mechanics Safe-Life analysis with a minimum of 1.25 x MEOP (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Cycle tests at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 8: Ion Thruster, Xenon An ion propulsion systems uses electric fields to accelerate positively charged ions through a grid. As the propellant, designers normally prefer inert gases with high atomic weights such as Xenon. The propellant may be ionized through electron bombardment from an internal cathode or by a microwave source. After acceleration through the charged grid, the high speed ion beam is neutralized by electrons emitted by an external cathode. The high exhaust velocities that ion thrusters achieve can provide an excellent specific impulse compared with chemical systems. Therefore, ion thrusters can be very mass efficient with their propellants. Ion thrusters, along with many electric propulsion systems, do not rely on the chemical energy of the propellant. Instead, the energy used to propel the spacecraft comes from the power system. To avoid the hazards associated with storage of energetic materials, satellites using electric propulsion systems can launch in an inert state, then harness solar energy to power their propulsion system. The hypothetical electric propulsion system used in this case study uses gaseous Xenon for a propellant. Busek is currently working on such a system which uses microwaves to ionize the propellant (Busek RF Ion Thruster, 2013). 87

112 Table 31: Ion Thruster Xenon Case, Hypothetical System Parameters. Propulsion System Type: Propellant: Propellant Mass: Ignition Method: MEOP: Pressurization: Propellant Storage: Vessel Failure Mode: Ion Thruster Gaseous Xenon (Xe) 0.4 kg Propellant ionized using microwave, then accelerated through a charged grid. 1,000 psia (~68 atm) Single-tank blow-down Metallic Pressure Vessel Leak-before-burst (LBB) Figure 13: Ion Thruster Xenon Case, Hypothetical System Schematic. Table 32: Ion Thruster Xenon Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences High pressure jet Unknown Burns or frostbite Displacement of oxygen in the air Catastrophic Asphyxiation Electric discharge Catastrophic Shock, EMI 88

113 Assuming a temperature of 20 C and using the ideal gas law, approximately 0.4 kg of stored Xenon gas could be stored at 1,000 psia. The metallic pressure vessel in this hypothetical system is assumed to have a Leak-before-burst (LBB) failure mode. Hazards Overview Xenon is an inert noble gas. The propellant only becomes a hazards due to its storage pressure and its capacity to displace oxygen. According to the MSDS for Xenon Gas, contact with rapidly expanding gases may cause burns or frostbite and Xenon acts as a simple asphyxiant (Material Safety Data Sheet: Xenon, 2013). If all of the 0.4 kg of Xenon propellant were to be released at once, it could fill a volume of approximately 2/3 m 3 at standard atmospheric conditions. Due to its high molecular weight, Xenon gas would sink in air. Care must be taken to ensure that the storage and work areas are adequately ventilated to prevent asphyxiation in case a leak occurs. As long as the hazard is dealt with accordingly, this hazard should not be a major deterrence. The hazards associated with asphyxiation and exposure to high pressure gas can be adequately contained with proper pressure vessel design, analysis, testing, and inspection. Other hazards associated with Ion thrusters are related to the electrical operation of the thruster and its power system. Premature electric discharge from the neutralizing cathode, or the internal cathode for certain ion propulsion systems, may present electromagnetic interference (EMI) or shock hazards. Electric discharge may initiate a fire if it occurs in an incendiary environment created by external factors such as Launch Vehicle propellant loading operations. If a microwave source is used in place of an internal cathode, it could cause EMI as well. Three inhibits may be required to prevent electric power from reaching the thruster. 89

114 Inhibits Table 33: Ion Thruster Xenon Case, Hypothetical Inhibits. Hazard Inhibits High pressure jet through fill port 1. Valve with Poppet Seal 2. Cap High pressure jet through thruster 1. Thruster valve Premature electric discharge 1. Power source inhibit 2. Power control inhibit #1 3. Power control inhibit #2 High Pressure Jet through Fill Port Personnel exposure to a high pressure jet through the Fill Port impeded by two inhibits; 1) one fill valve with a poppet, and 2) the sealing cap which fits over the fill valve. These two seals protect personnel during most operations. High Pressure Jet through Thruster Personnel exposure to a high pressure jet through the thruster is impeded by one inhibit; the thruster valve. As mentioned above, if this hazard constitute a critical hazard, the CubeSat developer would need to add one more valve between the pressure vessel and the thruster. Premature Electric Discharge The hazards associated with electric discharge and any other electrical hazards associated with the thruster are contained with three inhibits. One inhibit impedes power flow to the satellite while two more control switches prevent power from reaching the thruster hardware such as the microwave emitter and the neutralizing cathode. 90

115 Pressure Vessel Requirements The metallic pressure vessel would be subject to a burst safety factor of 1.5 according to AFSPCMAN Vol. 6 Section (AFSPCMAN Vol. 6, 2004). Since leakage of the propellant would not create a hazardous situation and the failure mode of the pressure vessel is Leak-before-burst (LBB), the pressure vessel is subject to Verification Approach A, Path 1. This verification approach is described in the discussion titled Metallic Pressure Vessels Verification Approach A Path 1 in Chapter V. The CubeSat developer would need to demonstrate the failure mode analytically or by test. If the failure mode turns out to be Brittle Fracture, then the developer would need to satisfy Verification Approach A, Path 2 instead and achieve a burst safety factor of 2. In summary, under Path 1, the CubeSat provider would be subject to stress analysis, a Fatigue-Life Demonstration, and a Loads and Environments Determination (AFSPCMAN Vol. 3, 2004). To summarize the testing requirements, the flight model would be subject to Nondestructive Examination (NDE) and a proof test at a level dependent of the Burst Factor (AFSPCMAN Vol. 3, 2004). A qualification model would undergo Random vibration testing at qualification levels, Burst test, and Nondestructive Examination (NDE). Case 9: Pulsed Plasma Thruster, Teflon A Pulsed Plasma Thrusters (PPT) offers many safety advantages when compared with other propulsion systems. A PPT uses electric discharge to ablate and vaporize a solid propellant, often Teflon. The vaporized propellant is then accelerated using an electric field. Clyde Space and Mars Science jointly market a system for CubeSats (Clyde Space, 2011). 91

116 The hypothetical PPT discussed in this example uses a spring to feed a solid Teflon propellant into the discharge area. The propellant is inert and does not require any pressure system. As the solid propellant is consumed, more is fed by spring into the discharge area. Table 34: PPT Teflon Case, Hypothetical System Parameters. Propulsion System Type: Propellant: Pulsed Plasma Thruster (PPT) Polytetrafluoroethylene (Teflon) Propellant Mass: kg (Clyde Space, 2011) Ignition Method: Propellant Storage: Electric discharge to ablate and vaporize propellant (Clyde Space, 2011) Solid propellant Table 35: PPT Teflon Case, Hypothetical Hazards. Hazard Estimated Severity Potential Consequences Electric discharge Catastrophic Shock, EMI Table 36: PPT Teflon Case, Hypothetical Inhibits. Hazard Inhibits Premature electric discharge 1. Power source inhibit 2. Power control inhibit #1 3. Power control inhibit #2 Hazards Overview The solid propellant, Teflon, is non-toxic, inert, and solid. Unlike most other propulsion system options, PPTs do not require a complex propellant containment system. The propellant, as a solid, can be secured mechanically. The only hazard that has been identified is associated with premature electric discharge. An electric discharge could produce electromagnetic interference (EMI) or it may initiate a fire if 92

117 it occurs in an incendiary environment created by external factors such as Lunch Vehicle propellant loading. Three inhibits may be required to prevent electric power from reaching the thruster. Inhibits The hazards associated with electric discharge are contained with three inhibits. One inhibit impedes power flow to the satellite while two more control switches prevent power from reaching the thruster. 93

118 VII. ORBITAL SAFETY As discussed in Chapter II METHODOLOGY, Range Safety and Orbital Safety are treated separately in this document. Most of the safety standards that are proposed fall into one of these two realms because the hazards are unique for the two distinct phases of the mission. This chapter focuses on Orbital Safety while Chapter V RANGE SAFETY, discusses Range Safety. The topic of Orbital Safety pertains to those hazards that are present after separation from the Launch Vehicle. All hazards that are present before that point fall into the realm of Range Safety. This chapter begins by addressing the risk of collision with other vehicles. The hazard of colliding with other spacecraft in orbit are discussed, with special attention given to the risk of collision with manned spacecraft such as the International Space Station (ISS). The ability to track a CubeSat is very important for preventing collisions on orbit. Before that discussion, however, close proximity operations are addressed. Immediately after separation from the host vehicle, the CubeSat propulsion system must be disabled until the CubeSat is unable to execute a maneuver and return to intercept the host vehicle. After the CubeSat has drifted far enough from the host vehicle, the two are no longer engaged in close proximity operations and general orbital operations safety standards should provide adequate protection against collision. Following the discussion of collisions, is a discussion of Command Security. A CubeSat operator may show a valiant effort to implement safe norms of behavior and meet orbital operations safety standards, but without proper Command Security, the spacecraft may be hijacked. If a third party with malicious intent could send propulsive commands to the spacecraft, they could jeopardize the safety of other spacecraft within range, which may include occupied spacecraft such as the ISS. The final topics of this chapter pertain to the safing and disposal of spacecraft. At the End-of-Life (EOL) of the mission, certain steps are often necessary to render the CubeSat inert in 94

119 order to prevent accumulation of orbital debris. Suppose that a propellant tank were left pressurized in orbit. If that tank were struck by a micrometeoroid, the impact could cause an explosion and generate new objects to jeopardize the safety of other spacecraft. This chapter discusses the concept of passivation. Another way to decrease the accumulation of space debris is to maneuver to a disposal orbit, de-orbit, or decrease the orbital altitude so that the CubeSat will re-enter the atmosphere within a reasonable timeframe. It is also important to consider the survivability of certain materials upon re-entry. Re-entry survivability analysis may help the CubeSat developer to make design decision, such as material selection, which decrease the feasibility or probability of casualty to human life on the ground. Collision with the Host Vehicle When a CubeSat separates from the P-POD, it projects away from the host vehicle with a separation velocity roughly on the order of 1 to 2 m/s. The separation velocity depends on the stiffness of the particular spring used and the mass of each CubeSats in the P-POD. For nonpropulsive CubeSats, that separation velocity has always provided sufficient separation such that the CubeSat cannot feasibly return and strike the host vehicle in the near term. CubeSats with propulsion systems, however, may possess the performance necessary to counteract the separation velocity and enter a collision course with the host vehicle. Apart from damaging the host vehicle and the CubeSat itself, such a collision may generate orbital debris which can jeopardize third-party spacecraft. One might suppose that if a CubeSat operator were to wait a certain amount of time before arming the propulsion system, the probability of collision could reduce significantly. Motivated by this possibility, the author originally set out to quantify the likelihood of such a collision. A model was created to calculate the probability of intercept after a range of delay times during which the CubeSat propulsion system is disabled. After a significant amount of work had been done, the author learned that the probability analysis would require a prohibitive 95

120 amount of processing time on the available hardware. Therefore, the author moth-balled the study and pursued other analyses to examine different hazards. However, after a hiatus which lasted the better part of a year, the author reviewed the model again with fresh eyes. This time, he noticed a trend in some of the plots he had generated. The trend did not help the author to quantify the probability of collision, but to determine envelopes of feasibility. After more analysis, the author found that the velocity change due to a propulsive burn, V, required to initiate a single-pass intercept maneuver increases linearly in the short term. The slope of this trend is the ratio of the separation velocity of the CubeSat in the direction tangential to the orbital velocity and the number of orbits since separation. This trend, which is shown for a baseline case in Figure 14 implies that a safety envelopes exists for which a single-pass intercept becomes infeasible. Figure 14: The short term velocity required for a single-pass intercept with the host vehicle increases approximately by the product of the tangential separation velocity and the number of orbits passed. Model Parameters: 600 km circular orbit after, separation velocity tangential +1 m/s. 96

121 While some second order effects cause slight deviations, for the first 100 orbits the first order trend is independent of orbital eccentricity, altitude, true anomaly at separation, and even non-tangential velocity. In fact, the trend holds very well for separation velocities that are offtangent by 80 degrees. Only near 89 degrees do the second order effects play a major role. These independencies are demonstrated later in this discussion. Analysis Figure 15, plotted using the Clohessy-Wiltshire (CW) equations, illustrates the relative trajectory of the CubeSat with respect to the primary satellite in a case where an erroneous burn ends in collision with the host. Note that in the example shown, a primary payload (P) separates from the launch vehicle prior to CubeSat separation. The launch vehicle drifts along the bluecolored trajectory from the origin, which remains fixed on the primary satellite (P). CubeSat separation occurs at the point labeled C, Deploy. The CubeSat then follows the green-colored trajectory for a delay time until a burn occurs at the point labeled CS, Burn. Finally, the burn puts the CubeSat in a collision trajectory, plotted in red, with the primary satellite. Figure 15: This plot of the relative position of a CubeSat with respect to the primary satellite illustrates a hypothetical mishap in which an erroneous burn causes collision with the primary. The origin is fixed at the location of the primary satellite. In the blue trajectory, the launch vehicle drifts until CubeSat deployment. In the green trajectory, the CubeSat drifts until a burn occurs. The red trajectory shows a collision with the primary satellite. 97

122 The following analysis simplifies the problem by neglecting any separation between the launch vehicle and the primary satellite. In other words, the analysis only considers the possibility of collision with the host vehicle from which the CubeSat deployed from. The host vehicle is the vehicle the P-POD remains attached to until deployment from the P-POD. In simple terms, the CubeSat separates from the host vehicle, and drifts for a certain amount of time. After that time has passed, model places the CubeSat in a trajectory that collides with the host vehicle. The V required to place the CubeSat in the intercept trajectory is recorded for a range of drifting times, and plotted. In less simple terms, the model begins before separation has occurred. Both the CubeSat and the host vehicle share an initial position. At time zero, the CubeSat separates from the host vehicle with a separation velocity of 1 to 2 m/s. An orbital propagator then uses Kepler s equations to calculate the trajectories of both vehicles through the burn delay time of the longest test case. Each time step in this propagation becomes a starting condition for the Lamberts problem of each test case. For each test case, which is defined by a specific burn delay time, the model uses the Keplerian propagator to determine the location of the primary satellite after various flight durations. For each flight duration, the model uses a Universal Variables Lamberts solver to calculate a trajectory that would result in collision. If that trajectory dips below an altitude of 100 km before intercept, the CubeSat is assumed to deorbit and that data point is suppressed. The model determines the minimum V that could feasible result in collision for each test case and the results can then be plotted as minimum V versus burn delay time, as shown in Figure 14. Assumptions Several assumptions are made in the analysis. First, all orbital propagations assume a two-body system with no orbital perturbations. For example, the dynamics neglect any effect of earth oblations, atmospheric drag, third-body effects with the sun and moon, etc. 98

123 The intercept trajectories predicted by the Universal Variables Lamberts solver assume impulsive burns. Any continuous burn would require slightly more V than an impulsive maneuver. A propulsion system that could generate an amount of V on the feasibility boundary would probably not actually achieve intercept. This lends conservativeness to the predications by erring on the side of safety. The Universal Variables Lamberts code used in this analysis can only predict intercept trajectories that result in a collision within one pass. While this provides very helpful information to those who wish to determine the short term risk of collision, future research that implements a multi-pass Lamberts solver would prove itself useful. With such an improvement, the analyst could identify even more conservative safety envelopes. The time of flight, TOF, between the impulsive burn and intercept is only calculated out to twice the host vehicle s orbital period. Some test cases were run where the orbital period was allowed to extend as far as 12 times the orbital period. However, since the Lamberts solver is limited to single-pass trajectories, the optimum TOF never surpassed approximately 1.8 times host s orbital period. For this reason, the code was limited to twice the host s orbital period. This assumption saved a very significant amount of computation time. The model checks each intercept trajectory for intersection with the Earth. Any trajectory that passes below 100 km altitude is rejected because most satellites will quickly deorbit at that altitude. Certainly, at that altitude, atmospheric drag becomes non-negligible and thus violates other assumptions that are made. As is discussed later, the rejection of trajectories that result in re-entry do not play a major role in short-term close proximity operations. This is even more true for higher orbits. Model Parameters For each test run, several parameters were defined. First, the initial orbital position and velocity was assumed. These parameters were used to set the initial altitude and the eccentricity. 99

124 Secondly, the time since perigee was defined for the time of separation. This allows for investigation of the effects of true anomaly at separation. Finally, the separation velocity was defined in the in the normal in-plane, tangential, and out-of-plane directions. Unless otherwise mentioned, every case was run with a separation speed of 1 m/s. Lamberts Method, Universal Variables The variant of the Lamberts method used here utilizes Universal Variables. The method predicts possible trajectories connecting two special locations, given a time-of-flight. All trajectories are calculated using a Kepler s equations. Model Validation The results that were obtained for close-proximity separation trajectories appeared justifiable. Velocity change in the tangential direction should affect the period of the orbit more than velocity change in any other direction. That change in orbital period should then contribute considerably to orbital drift. Consider a separation velocity that causes a 1-second decrease in orbital period. At orbital speeds on the order of 7 km/s, one might expect roughly 7 km of drift per orbit. In comparison, velocity change in the normal direction (towards or away from the Earth for circular orbits) primarily affects the eccentricity of an orbit with only a secondary effect on orbital period. Similarly, an out-of-plane velocity change primarily affects inclination rather than orbital period. While this thought process supported the results, the author chose to attempt another form of validation. Besides the neglect of orbital perturbations, the assumptions that were made in the model do not limit the delay time. Therefore, the model should give reasonable predictions after many orbits of burn delay time. The author considered the drifting as a long-term phasing maneuver. The tangential separation velocity changes the orbital period of the CubeSat, causing a gradual phase drift. After 360 degrees of drift, the trend should start over and repeat, as is shown in Figure

125 Figure 16: The long-term analysis spanning 8000 orbits shows the repeating pattern. Model Parameters: 600 km circular orbit, separation velocity tangential 1 m/s. One might expect the pattern to appear symmetric about the point signifying 180 degrees of drift, for at that point the optimum trajectory would logically change directions. To test the model against these hypotheses, the author plotted the results for a 600 km circular orbit with delay times spanning 3000 orbits (~200 days). However, instead of symmetry about the point of 180 degree phase difference (~1250 orbits), the V required increased until it reached a discontinuity near the point of 360 degree phase difference (~2500 orbits), as shown in the blue line of Figure

126 After much examination, the author attributed the discontinuity to the following phenomenon. For certain test cases, the optimum time of flight for the intercept trajectory was correctly rejected by the model because the respective trajectory would have passed into the atmosphere of the earth, leading to a de-orbit condition. Figure 17: The long-term analysis spanning 3000 orbits shows the effects of the de-orbit condition which nullifies some of the points that would otherwise serve as optima. Model Parameters: 600 km circular orbit, separation velocity tangential - 1 m/s. Figure 18 shows the range of flight times from zero to twice the orbital period. Notice that the optimum flight, approximately 0.8 orbital periods by solution 1, is neglected due to the de-orbit condition. In his case, another local optimum is selected at approximately 1.8 orbital periods, also by solution 1. The case shown in Figure 18 occurs near the discontinuity in Figure

127 To verify the cause of the discontinuity, the author ran the model with no de-orbit filtering. After allowing trajectories to pass through the Earth, the results appeared much more continuous. Plotted in green next to the original results in Figure 17, the reader will notice that instead of an abrupt jump from over 1200 m/s to just below 100 m/s, the no earth validation case descends gradually, with many intermediate points, from a maximum of approximately 1000 m/s down to the same point just below 100 m/s. Note that the close-proximity cases near 0 orbits and again near 2500 orbits agree for both cases. At that point, the true optimum intercept trajectories no longer pass through the Earth. Figure 18: The optimum TOF for this test case is correctly rejected by the model because the respective trajectory would have intersected the earth. Model Parameters: 600 km circular orbit after 2060 orbits of delay time, separation velocity tangential - 1 m/s. 103

128 The reader may notice that even the no-earth validation case is not perfectly symmetric about the point of 180 degree phase difference (~1250 orbits). Consider the fact that return trajectories will look different when the CubeSat is trailing the host in its orbit, compared to when the CubeSat is leading the host. For this reason, the trend is mirrored for opposite separation velocities, as shown in Figure 19. Figure 19: The long-term trend shown here for a positive tangential separation velocity mirrors the trend for a negative tangential separation velocity. Model Parameters: 600 km circular orbit, separation velocity tangential + 1 m/s (blue), - 1 m/s (red). The long-term trends are mirrored for opposite separation velocities, rather than being identical. On the short term, however, the trends are nearly identical, as shown in Figure

129 Figure 20: In the near term, the separation velocity makes very little difference. Model Parameters: 600 km circular orbit, separation velocity tangential 1 and 2 m/s. The slope is normalized in comparison with the separation velocity. 105

130 Results Linear Trend for Close-Proximity Operations As was shown in Figure 14, the V required to return and intercept with the host vehicle after CubeSat separation, Vint, increases linearly over time in the short term. The slope of the trend is the ratio of the separation velocity of the CubeSat in the tangential direction and the number of orbits since separation, N orbits, V int V sep ˆ N orbits where V sep is the separation velocity between the CubeSat and the host vehicle (~ 1 m/s) and ˆ is the unit vector pointing into the direction of orbital velocity. To put the trend in more temporal terms, V int V T sep orbit ˆ t burn where T orbit is the orbital period and t burn is the time delay between CubeSat separation and the impulsive burn maneuver. If the CubeSat provider may find the following algebraic manipulation useful. It allows the CubeSat provider to use their system s maximum V capabilities, V CS, max, to determine a safe delay time, t burn, safe, after which the propulsion system may be armed. t burn, safe V V CS,max sep ˆ T orbit 106

131 Altitude (km) [peri. x apo.] Orbit Table 37: Model parameters for each run. True Anomaly at Separation Speed (m/s) Separation Velocity In-Plane (degrees) Out-of-Plane (degrees) 600 x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x 600 N/A x x x x x 300 N/A x 300 N/A x 600 N/A x 600 N/A Independencies Surprisingly, the linear trend discussed above varies very little due to changes in parameters such as orbital altitude, eccentricity, true anomaly at separation, separation speed, and separation direction. Figure 21 illustrates a common trend among every analytical run spanning a range of parameters. The varying parameters are shown in Table 37. The test runs vary orbital altitude, eccentricity, true anomaly at CubeSat separation, separation speed, and separation direction. Figure 21 shows the trends for delay times up to 100 orbits, which represents approximately one 107

132 week for Low Earth Orbit (LEO). For example, a 600 km circular orbit with a period of 96 minutes completes 100 orbits after 6.71 days. A 300 km circular orbit with a period of 90 minutes will complete 100 orbits after 6.28 days. To compare model data to the trend, the trend may be converted to a unit equality, Vint V sep ˆ N orbits 1 Figure 22 shows the results plotted in this way and can be compared with unity. This allows the reader to see the proportional variation of each run with respect to the trend. For the first few orbital periods, some of the result start high. This is because initially t burn and N orbits are zero. The reader will also notice that deviation from the trend line increases with t burn. The trend is only valid for relatively short timespans, compared to the 2500 cycle which spans nearly six months of drift. The results on that time frame, shown in Figure 17, certainly would not fit the trend discussed in this section. However, for 100 orbits in approximately one week, the linear trend fits nicely for our purposes. After more than a week of drift, the CubeSat operator would not continue to operate in a close-proximity mode, but would adhere to the more general orbital safety standards. 108

133 Figure 21: For these ranges, slope is nearly independent of separation velocity, direction, inclination, and true anomaly at separation. 109

134 Figure 22: For these ranges the trend stays above ~90% of the predicted trend. Anywhere below can be considered a safe zone. 110

135 All of the results shown in Figure 22 remain above 90% of the unit equality given above. The results deviate more than 10% above the trend, but never more than 10% below. In other words, CubeSats that separate with the parameters matching the cases shown could safely initiate their propulsion system when the ratio of their performance and the performance needed to intercept the host drops below 90%. In this analysis, each variation from the baseline was treated separately. Future research may examine the worst case of combining variations. For example, suppose a CubeSat were to separate 80 from the tangential direction in an eccentric orbit. Similarly, suppose a CubeSat were to separate with 2 m/s at 80 from the tangential direction. Figure 22 and Figure 24 demonstrate that even when the separation velocity is offset by 89 from the tangential direction, the results follow the trend remarkably well. Notice that the tangential component of the separation velocities, in these cases are only 0.86% of the total separation velocity. Still, the predominant trend is the same. One may claim, in this case that the linear trend is at least two orders of magnitude stronger than the secondary trends. Note also that the effects of the non-tangential velocities do not grow over time. Therefore, their proportional effect decreases at higher delay times as the effect due to tangential velocity increases. 111

136 Figure 23: Separation velocity 89 degrees offset from the tangential velocity, in-plane. Figure 24: Separation velocity 89 degrees offset from the tangential velocity, out-of-plane. 112

137 Examples Suppose a CubeSat propulsion system can deliver a constant acceleration resulting in 3 m/s of V per orbital periods. Consider also that this propulsion system s lifetime V is capped at 6 m/s and that the CubeSat separates from the host vehicle with a tangential separation velocity of 1 m/s. As shown in Figure 25, such a propulsion system could safely operate after four orbital periods have passed since separation. Figure 25: In this example, the CubeSat performance profile would allow the propulsion system to be safely armed four orbital periods after deployment. Alternatively, consider a CubeSat that can produce much more lifetime V, perhaps 120 m/s, but it can only accelerate at 0.5 m/s per orbital period. If it separates from the host vehicle with 1 m/s tangential separation velocity, the CubeSat could not return to the host vehicle by its own propulsion in the short term, at least not within a single pass trajectory, as shown in Figure 26. Despite its ability to produce twenty times more V than the previous example, it would not need to wait to operate its propulsion system beyond a reasonable time, possibly defined by the 113

138 need to reduce thruster plume impingement on the host vehicle or on other CubeSats. Therefore, for certain thrust to weight ratios, no wait is necessary to eliminate the feasibility of a single-pass collision trajectory with the host vehicle. Figure 26: In this example, the CubeSat performance profile would not require the operator to wait to enable the propulsion system beyond a reasonable timeframe necessary to reduce thruster plume impingement on the host vehicle. Collision with Third Party Satellites The freedom to exercise control over the trajectory of a satellite comes with a new level of responsibility in proportion to the new hazards that are created. With a spirit of good citizenship, CubeSat operators must work diligently with the larger space community to promote orbital safety. While the primary satellite provider might possess the authority to de-manifest a CubeSat that jeopardizes their mission, third party satellite operators normally have no voice in the matter. 114

139 The authorities that can currently influence a CubeSat mission are primarily concerned with safety during ground operations, launch, and separation. Some operators, however, impose orbital safety requirements on themselves. NASA missions, for example, are expected to follow NASA STD which discusses methods for limiting orbital debris and gives instruction for the Orbital Debris Assessment Report (ODAR). Similarly Air Force missions are expected to adhere to AFI which outlines the role of JSpOC in orbital safety, among other topics. See Chapter III, EXISTING STANDARDS, for a more in-depth look at these documents. AFI sets limits on the probability of collision with space debris, active satellites, and manned satellites. According to AFI Section 5.2.1, the probability of collision with active satellites should be less than 10 x 10-6, or 10:1,000,000, while the probability of collision with manned spacecraft should be less than 1 x 10-6, or 1:1,000,000. (AFI , 2010) This document does not make generalities to predict the probability of collision with operating satellites, manned vehicles, nor space debris. This discussion will not claim that the probability of collision while operating at certain altitudes, inclinations, and cross-sectional areas would comply with the Air Force s instructions. The hazard must be assessed separately, during operations. While this study will not predict the probabilities of collision, it can draw some useful conclusions and perspective from the requirements contained in AFI Notice that AFI draws a different requirement to protect manned vehicles than to protect unmanned operating vehicles. The acceptable level of probability for collisions with manned vehicles is an order of magnitude lower in comparison with unmanned operating vehicles. This suggest that the Air regards manned vehicle safety with greater priority than unmanned operating vehicle safety. Fortunately, the number of manned vehicles in orbit is much smaller than the number of unmanned operating vehicles. 115

140 The Federal Communications Commission (FCC) also emphasizes concern for spacecraft that maneuver near inhabitable objects. They recommend communicating with the operator of that object. For satellites that will maneuver at altitudes used by inhabitable orbital objects, the applicant should indicate whether any measures have been taken to coordinate operations with the operator of such object. (Federal Communications Commission, 2013) At present, one particular manned vehicle remains as a fixture in LEO. The International Space Station (ISS) has hosted a continuous rotation of manned crews since the year 2000, and is expected to remain at least until The ISS is also the largest occupied object in space, which unfortunately improves its chances for collision with other objects. The ISS operates within a specific range of altitudes, approximately 330 km to 410 km (International Space Station, 2013). Given that information, one could perform a feasibility analysis to determine whether a propulsive CubeSat could impinge on that range of altitudes. Any collision or near miss with the ISS could cripple the CubeSat industry. However, some precautions could be implemented to reduce the hazards associated with such satellites. In order to advise the necessity of such precautions, it is useful to establish a feasibility envelope. Maneuver Envelope Study This study assesses the feasibility for a CubeSat to pass through certain altitudes, given initial conditions and propulsion performance. While not every pair of objects that pass through a given altitude can collide, this is the first step in ruling out infeasible collisions. Parameters such as inclination and Right Ascension of the Ascending Node (RAAN) also affect the feasibility for collision. After determining the feasibility for a CubeSat to reach certain altitudes, given initial 116

141 conditions and propulsive capability, a safety envelope is drawn specifically for collisions with the ISS. The author hopes that these first-order analyses prove useful to CubeSat developer as they seek to evaluate and contain the hazards associated with their mission. The author also hopes that this set of analyses lends itself as a starting point for mission specific analysis. Before diving into the analysis, it is useful to discuss the relationship between propellant quantity, specific impulse (I sp ), and velocity change ( V). Equation 1 relates these quantities in using the Rocket Equation rocket equation, Equation 1: The Rocket Equation V Isp g 0 1 ln 1 M f where g 0 is the gravitational acceleration at the surface of the earth and M f is the mass fraction, given as, Equation 2: The Rocket Equation M f m 1 m f 0 where m f is the propellant mass and m 0 is the total wet mass of the vehicle (including propellant) before burn. The contour plot in Figure 27 shows the V generated with various levels of I sp and various propellant mass fractions. For example, a CubeSat propulsion system capable of 200 s of I sp which burns 10% of its mass in propellant could achieve approximately 0.2 km/s of V. The reader may find it useful to come back to this plot while reading the following analysis. 117

142 Figure 27: Velocity change after an impulsive burn. Figure 28: Visualization of a single-burn impulsive maneuver. 118

143 Impulsive Maneuvers Beginning with the most basic analysis, consider a CubeSat that is capable of performing an impulsive maneuver. The model used in this analysis determines the maximum reachable altitude, given a range of V. This conservative prediction indicates which orbits could feasibly be at risk. The trajectory is modeled as the first burn in a Hohmann Transfer from a circular orbit at a range of altitudes between 100 and 2,000 km. Several assumptions are made in this analysis. Since orbital inclination and the Right Ascension of the Ascending Node (RAAN) are not considered in this preliminary analysis, the mathematics can be simplified by limiting motion to two dimensional space. This analysis also neglects orbital perturbation, reducing all orbital dynamics to a two-body problem. The pre-burn trajectory is assumed to be a circular orbit. In order to analyze the situation as a Hohmann Transfer, all maneuvers are assumed to as impulsive burns in a direction tangent to the orbital velocity. The contour plot in Figure 29 shows the maximum feasible altitude that a CubeSat could reach after in impulsive burn starting from a circular orbit at is initial altitude, over a range of V. The plot may prove useful for preliminary prediction of the risk of collision. For example, consider a spacecraft for which the propellant mass accounts for 1/3 of the spacecraft mass which operates with an Isp of 200 s. From Figure 27, one can determine that that the propulsion system could generate a maximum V of approximately 0.8 km/s. Figure 29 shows that if this spacecraft started at an altitude of 100 km, it could theoretically reach an apogee above 3,000 km in one burn. While such a spacecraft could not intercept satellites in geostationary earth orbit (GEO) orbits, it could intersect the trajectory of any spacecraft in low earth orbit (LEO), including the ISS. 119

144 Continuous Burn Maneuvers The next analysis does not assume an impulsive burn. Instead, the burn is allowed to occur over time with a finite amount of thrust. For a given I so, continuous burns are generally less efficient than impulsive burns. Since the propulsive capabilities are reduced, the number of satellites potentially in jeopardy decreases with longer burn times. Figure 29: Apogee change after an impulsive burn. In this model, the author used an ordinary differential equaion solver to propagate the trajectory throughout the burn. After the burn completes, the trajectory simply follows two-body dynamics and the resulting apogee and perigee are calculated. 120

145 Similar to the impulsive burn analysis, this analysis continues to assume that the spacecraft begins in a circular orbit. This analsis also continues to neglect any orbital perturbations. During the duration of the burn, thrust is assumed to be constant. Control Modes While thrust is assumed to be constant, the direction of thrust depends on the control mode. Figure 30 depicts each of the control modes that were used in this analysis. Control Mode 1 Control Mode 2 Control Mode 3 Figure 30: Thrust direction control modes. Control Mode 1 models a CubeSat with active attitude control, burning tangentially to the velocity vector. Since thrusting in the tangential direction is the most efficient way to raise or lower the apogee and perigee, this mode results in the greatest change in altitude for a continuous burn. The model also represents the most difficult of the three control modes to implement. The left side of Figure 31 shows the initial and final orbit for a sample maneuver and the trajectory that the satellite follows while thrusting. On the right is shown the angle between the tangential direction and the thrust direction throughout the burn in degrees. In an ideal analysis, there would be no difference for Control Mode 1. However, due to the step sizes taken by the solver and other computation errors, there is a small variation. 121

146 Figure 31: Control Mode 1: The thrust vector tracks the velocity vector throughout the burn. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn. Control Mode 2 and 3 both model a CubeSat with an inertially fixed attitude. Control Mode 2 approximates the most effective case, given that condition. The thrust direction is aimed approximately into the average velocity direction throughout the duration of the burn. Since the actual velocity direction is unknown at the beginning of the burn, this is estimated by propagating the velocity of the original orbit throughout the duration of the burn. The left side of Figure 32 shows the initial and final orbit for a sample maneuver and the trajectory that the satellite follows while thrusting. On the right is shown the angle between the tangential direction and the thrust direction throughout the burn in degrees. Notice that near the middle the burn, the thrust direction approximates the tangential direction. 122

147 Figure 32: Control Mode 2: The thrust vector is inertial fixed approximately pointing toward the average velocity direction. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn. As mentioned above, Control mode 3 models a CubeSat with an inertially fixed attitude. Unlike Control Mode 2, the direction is not optimized in any way. Thrust begins tangential to the velocity vector at the beginning of the burn. Without attitude control during the burn the thrust vector deviates away from the velocity vector. Of the three control modes, this is the least effective way to change altitudes. Therefore, compared with the two other control modes, this one carries the least risk to other satellites since fewer orbits are in range. The left side of Figure 33Figure 31 shows the initial and final orbit for a sample maneuver and the trajectory that the satellite follows while thruster. On the right is shown the angle between the tangential direction and the thrust direction throughout the burn in degrees. Notice that in the beginning, the thrust direction approximates the tangential direction and then deviates away throughout the burn. 123

148 Figure 33: Control Mode 3: The thrust vector is inertial fixed toward at the initial velocity direction. Trajectories are shown on the left. On the right, the thrust direction is plotted in red, relative to the tangential direction throughout the burn. Continuous Burn Analysis Results Figure 34 through Figure 36 show results for Control Mode 1 through 3, in order. Burn duration has a significant effect on the maneuvering capabilities of a CubeSat. For burn durations of zero, the burn is simply impulsive and is no different from the first burn of a Hohmann Transfer maneuver, as is analyzed previously. As burn duration grows, the spacecraft spends less time burning near the apsis of its orbit. The less efficient burn leads to diminished climbing or descending capabilities. The lower boundary of the surface of the earth is shown in a blue dashed line in Figure 34 and Figure 35. Shown in a red dotted line are approximate maximum and minimum altitudes for the orbit of the ISS. If a satellite under the lower limit ascends above that limit, the CubeSat may intercept the ISS. If a satellite starting above the upper limit descends below that limit, that CubeSat may intercept the ISS as well. 124

149 Figure 34: Maximum altitude range for Control Mode

150 Figure 35: Maximum altitude range for Control Mode

151 Figure 36: Maximum altitude range for Control Mode

152 Figure 37 is derived from the same model. For each point where the CubeSat crosses into the boundaries of the ISS orbit, the burn duration for that point is plotted against the V. The resulting lines shown approximate the feasibility boundaries for collision with the ISS. Given an I sp and an initial altitude, if a CubeSat lies above and to the left of the trend in Figure 37, it cannot reach the altitude limits assumed for the ISS. Such a satellite would lie in a safe zone. Figure 37 is plotted assuming Control Mode 1 in which the thrust vector tracks the velocity vector. Since this represents the most effective control mode, the plot shows a conservative worst case. As an example, a CubeSat that begins in a circular orbit with an altitude of 600 km that is capable of generating 70 m/s of V over 40 minutes could theoretically intercept the ISS. However, if the same spacecraft could only generate that amount of V over a 60 minute burn, it could not intercept the ISS in one burn. Note that certain orbital perturbations, such as atmospheric drag, could move a satellite out of the safety envelope. This is particularly true for satellites operating at altitudes above the ISS. Those operating below the ISS are more likely to drift farther towards the earth, and away from the ISS. CubeSat developers should prepare for safe operations throughout their mission life, including any period in which the satellite leaves the safety zone. 128

153 Figure 37: Boundary for safe maneuvers with respect to the ISS for a range of V up to 0.1 km/s (100 m/s). 129

154 Pointing Error When assessing orbital operations safety, it is important to understand how pointing errors might affect the outcome of a maneuver. Analyzing the propagation of pointing error can help CubeSat developers to determine attitude pointing requirements for their propulsive satellites. This discussion presents a sample analysis showing the impact of in-plane pointing error as well as out-of-plane pointing error for Hohmann Transfer maneuvers between two circular orbits. Analysis The model assumes that the CubeSat begins in a circular orbit with an altitude of Alt 1. The model calculates an ideal Hohmann Transfer trajectory that would place the spacecraft in a circular orbit at an altitude of Alt 2. The model then introduces pointing error into the first burn of the Hohmann Transfer. Figure 38 illustrates the ideal V vector compared with the non-ideal V vector (not to scale). After propagating the non-ideal transfer orbit for 180 degrees to the next apsis, the second burn occurs. The second burn also incorporates the same amount of pointing error as the first. The direction of the pointing errors for the two burns are matched in order to maximize cumulative effect in the final trajectory error. Figure 38 also contains a visualization of the ideal trajectory compared with a sample non-ideal trajectory. The model assumes that the burns are perfectly timed and impulsive. The model does not assume any distribution function for pointing error, but calculates the results of discrete pointing error values. The results can then be used to determine the maximum trajectory error that is feasible within pointing error bounds. 130

155 Figure 38: Visualization of a trajectory with pointing error. In order to predict the effects of in-plane pointing error, the model introduces error into the thrust direction while preserving the ideal magnitude. The resulting trajectory remains inplane but the altitude of the perigee and apogee miss the target orbit. The model performs similar analysis for out-of-plane pointing error. This error results in both altitude error and inclination error. The model considers the results of in-plane and out-of-plane pointing errors, and determines the worst overshoot or undershoot for altitude and the worst inclination error. The 131

156 feasible errors of any given error bound include the feasible error of each particular angle within that bound. For example, suppose that a pointing error of +10 were to result in 2 km altitude error and a pointing error of +5 resulted in a 4 km altitude error. The true worst feasible altitude error for ±10 would be at least 4km. For this reason, the worst case error accumulates as the pointing error bound grows. Results Figure 39 shows the maximum feasible altitude errors, Alt 2, and inclination errors, i, due to pointing errors,, from 0 to 10. The altitude of the initial circular orbit is 500 km with target orbits ranging from 600 km to 1000 km. Notice that the maximum overshoot increases as the error bounds grow from 0 to approximately 2 and the overshoot remains constant after that. The maximum undershoot grows with greater pointing error throughout the range. The inclination error grows linearly with pointing error. As mentioned earlier, CubeSat developers can implement similar analyses in order to determine pointing error requirements for their Attitude Determination and Control System (ADCS). In the example shown in Figure 39, a CubeSat maneuvering from a 500 km circular orbit to an 800 km circular orbit that needs to stay within 4 km of the desired altitude could meet its requirements with a pointing error of 7. If that same CubeSat, however could only accept an inclination error of 0.05, then the ADCS would need to ensure a pointing error less than 4.5. Note that this analysis assumes perfect timing. Timing error for thrusting maneuvers can lead to significant trajectory errors. A CubeSat developer a encouraged to include this in their mission-specific analysis. Trackability CubeSat operators normally rely on the services of the Joint Space Operations Center (JSpOC), which is operated by Joint Functional Component Command for Space (JFCC SPACE), to track their spacecraft in orbit. JSpOC also provides support to help satellite operators to predict 132

157 and avoid collisions, as discussed in AFI Space Safety Mishap Prevention Program (AFI , 2010). A brief summary of some important information contained in AFI can be found in the section titled AFI : Space Safety and Mishap Prevention Program in Chapter III of this document. Figure 39: Feasible altitude error due to pointing error. 133

158 The services provided by the JSpOC are critical for orbital operations safety. The JSpOC tracks spacecraft on orbit using a variety of methods including radar and optical observations. The presence of CubeSats in orbit may pose a challenge for the JSpOC due to their size, especially if those CubeSats are capable of changing trajectories using propulsion systems. Cooperation with the JSpOC is one way in which CubeSat programs can operate as good citizens while helping the JSpOC to provide them with the important services that they rely on. Low V Maneuvers As discussed in the section titled AFI : Space Safety and Mishap Prevention Program in Chapter III of this document, maneuvers under a certain V threshold do not require a Conjunction Assessment or Collision Avoidance. Also discussed in that section, Richard C. Diamantopoulos, who works for the Scitor Corporation in support of JFCC SPACE, shared that satellites are screened for collision avoidance using a 1 km (X, Y-axes) x 200 m (Z-axis) [ellipsoid] around the current [element set]. Any movement from a currently established [element set] in the Satellite Catalog without prior coordination with the JSpOC affects their ability to predict conjunctions and avoid collisions until the new [element set] is confirmed in the Satellite Catalog (Diamantopoulos, Correspondence, 2013). CubeSats that use their propulsion systems for drag compensation or other orbital maintenance do not likely need to notify JSpOC before every burn as long as they remain within that 1 km x 1 km x 200 m ellipsoid. CubeSat operators should work with their launch provider, launch integrator, and JFCC Space to establish a mission-specific plan. Methods of Improving Trackability Communication with JFCC SPACE In order to fully benefit from the services that JSpOC provides and in order to improve the level of safety for all satellites on orbit, the CubeSat developer should provide certain information to JFCC SPACE. Knowledge the transmission frequencies of the CubeSat radios 134

159 helps the JSpOC to identify CubeSat from one another, especially just after separation before the CubeSats have dispersed. By listening on those frequencies, the JSpOC can also distinguish the CubeSats from space debris. The launch provider often provides this information to JFCC SPACE (Diamantopoulos & Quinonez, Meeting to Discuss Orbital Safety, 2013). CubeSat providers should verify with their launch provider and launch integrator that this information is given to JFCC SPACE. The CubeSat operator will need to work with their launch provider and launch integrator to establish direct contact with JFCC SPACE in order to form a plan for safe orbital operations. During orbital operations, the CubeSat provider will need to communicate with JFCC SPACE in order to notify them of upcoming maneuvers. The CubeSat provider should establish first contact with JFCC SPACE by working with their launch provider and launch integrator to submit an Orbital Data Request (ODR) form to ODR@space-track.org, or USG_ODR@us.af.mil for military requests. This establishes a pipeline for a CubeSat operator to request Conjunction Assessments, and to receive conjunction predictions. The ODR and instructions are available online at A CubeSat operator should also request an account with (Orbital Data Request, 2013). In most cases, the CubeSat operator should not submit the ODR separate from the launch provider. However, if for any reason the launch provider does not wish to support this process, the CubeSat operator should submit the ODR independently. Radio Reflectors and RFID CubeSats are more difficult to track compared with larger satellites simply due to their size. CubeSats have a smaller cross section, for radar and optical sensors, compared with larger satellites. In fact, CubeSats are closer in size to some pieces of orbital debris. Imagine the challenge of tracking an object the size of a grape-fruit from hundreds of kilometers away, when that object is traveling at speeds near 7.5 km/s. The angular diameter of a 3U CubeSat at 500 km 135

160 is less than 4 x 10-5 degrees when the angular velocity of that CubeSat flying past a ground station is nearly 0.9 degrees per second. Luckily, there are steps that CubeSat developer can take to help the JSpOC identify and track their satellites. First, the developer can help including a beacon in their design and notifying JFCC SPACE of their transmission frequencies. The JSpOC can watch for those frequencies. One might compare this to a person who, lost in the dark at night, turns on a small flash light which helps the search party to locate them. Knowledge of the transmission frequency helps the JSpOC to distinguish one CubeSat from another, especially just after deployment before the CubeSats have dispersed. Use of beacons should decrease the time it takes to establish determine initial orbital parameters. Another way a CubeSat developer may help the JSpOC to find their satellite is by including a radar transponder in their design. Tracking stations can then ping the CubeSat. This helps the JSpOC to pinpoint the CubeSat s location and to identify one CubeSat from another without requiring constant transmission which uses power resources. The previous examples are active ways that the CubeSat designer can help the JSpOC to identify and track their satellite. However, the CubeSat will likely lose power before de-orbiting. After that point, the JSpOC will have little help in tracking the object. To prevent this disadvantage, a CubeSat designer can install a passive device to improve their trackability. For example, a CubeSat design could include a Radio-Frequency Identification (RFID) device which reflects a certain frequency. Like a transponder, a passive RFID device could be pinged by a ground station. Such a device could be customized to help distinguish one CubeSat from another. Since the device would not use onboard electrical power resources, it could help the JSpOC to track the CubeSat long past its operational lifetime (Diamantopoulos & Quinonez, Meeting to Discuss Orbital Safety, 2013). Any way that CubeSat developers can improve their trackability will improve orbital safety by allowing the JSpOC to predict conjunctions more effectively. Improved trackability also 136

161 improves the quality of tracking data the operator receives from the JSpOC. This is a win-win situation. Command Security Steps may be taken by the CubeSat operator to ensure that their propulsive maneuvers do not pose unnecessary risk to other spacecraft. A commitment to good citizenship on orbit greatly improves the level of safety for a CubeSat mission. Suppose, however, that a third party with malicious intent were to hijack a CubeSat. If they succeeded in transmitting valid command signals, they may send the CubeSat on a trajectory which puts other spacecraft and human life at risk. Depending on the CubeSat s operating orbit and performance limitations, this may jeopardize personnel safety aboard manned spacecraft such as the International Space Station (ISS). Contributing Factors Many factors affect the risk that a CubeSat may become hijacked by an individual, organization, or foreign entity with malicious intent. Generally, one could expect that CubeSats with high levels of performance and poor command security would be at a higher risk of hijacking. A benign satellite with poor command security may be of no use to a hijacker. On the other end, a highly capable satellite with effective command security may also pose little risk of hijacking. Therefore, it is reasonable to consider the risk of hijacking as being influenced by capability-related factors and security-related factors. The necessary level of command security may depend partly on the capabilities of the CubeSat. It would be pointless to protect a CubeSat that can do no harm, but CubeSats that are capable of intercepting other satellites with little notice need to be protected against hijacking. Capability-Related Factors In the event of a CubeSat hijacking, the offending party would be relying on the CubeSat hardware to accomplish their attack. The outcome largely depends on the capability of the 137

162 CubeSat itself. The V limitations of the CubeSat, its thrust-to-weight ratio, its orbital parameters, and its attitude determination and control system performance can all affect the amount of damage the hijacker could inflict and the likelihood that the hijacker could succeed. A CubeSat that is capable of impulsive maneuvers that intersect the orbit of the ISS could be more dangerous than a CubeSat with the same V limit but with a lower thrust-to-weight ratio. The latter CubeSat may need multiple passes in order to enter into an intercept trajectory. Since more time would be needed to inflict damage, the rightful CubeSat operator would have more time to respond. During that time, the ISS could maneuver to a safe orbit if needed and the astronauts could take shelter inside a reentry vehicle and prepare for a possible collision. Security-Related Factors In order to carry out a hijacking, the offending party would require the following. Technology capable of tracking and communicating with CubeSats on their command frequency Access to the command codes Access to any encryption keys that are used First, the offending party would need access to the technology needed to command the CubeSat. Since many CubeSat ground stations use amateur radio equipment, the offender would have very little trouble sending transmissions to the CubeSat. If the offending party were to succeed in sending signals to the CubeSat over the correct frequency, they would then need access to the command codes in order to send and receive useful commands. Finally, if the CubeSat communications are encrypted, the offending party would need access to the encryption keys in order to send commands. Access to command codes and encryption keys do not necessarily require that the hijacker has knowledge of them. The hijacker knows that there exists at least one ground station with the right equipment. Similarly, that equipment is likely configured to send commands. When this is the case, the hijacker may choose to hack into the ground station remotely or break into the 138

163 ground station physically rather than searching for the encryption keys for use on their own equipment. Physical and cyber security are critical for spacecraft operation control centers. According to an article posted on the Infosec Island website, in 2007 and 2008 four cases were reported of foreign cyber-attacks on NASA spacecraft. The spacecraft operators of Landsat- 7 and Terra EOS AM-1 experienced interference and sometimes loss of command of their spacecraft. China is believed to be have carried out these attacks. In the attacks on Terra EOS AM-1, the responsible party achieved all steps required to command the spacecraft but did not issue commands (Paganini, 2012). Another article noted that the operator s use of the internet to connect with remote ground stations became a vulnerability (Humphries, 2011). The CubeSat community has a history of collaborating with other ground stations. This allows CubeSat operators to collect data from their satellite more often without building a network of ground stations themselves. However, CubeSat operators should be careful to protect their command authority whenever collaborating with remote ground stations. Even when the other ground station is secure, the remote connection may become a vulnerability as it did with these NASA satellites. Potential Methods of Mitigation Certain steps could be taken to defend against potential CubeSat hijackers. Some of these mitigation methods could be implemented in the satellite design and some would be implemented on the ground. Some methods would even call for programmatic security measures. Command encryption Command encryption would decreasing the likelihood of hijacking. This would require that security measures be taken to protect the encryption key. Perhaps only necessary personnel should have access to the encryption key. Software encryption is simple to implement but may pose significant demands to the CubeSat onboard processor. Hardware encryption involves installing a component strictly for the 139

164 purposes of encrypting and decrypting messages. This may affect the mass budget of the CubeSat but saves processing power and generally provides a higher level of security. Encryption can be an effective means of preventing hijackers from taking command of a spacecraft only if the encryption key on the ground is secured. The CubeSat operator would need to dedicate themselves to maintaining secrecy of the key and maintaining control of any hardware keys. Ground Station A ground station could use very advanced encryption techniques or hardware requirement that make sending commands to the CubeSat nearly impossible at other ground stations. However, if the front door to the ground station were left unlocked routinely, the overall level of security would be very poor. With an over-emphasis on command encryption, the operator could possibly neglect physical ground station security. Perhaps a hijacker could walk in, send commands, and leave unnoticed. When the potential hazard exists, the CubeSat operator must implement appropriate ground station security measures. Among other things, these may include locking the facility, blocking any windows, limiting access to the communications hardware, protecting computers with strong passwords, and surveillance. Cyber Security As discussed earlier, cyber security is essential. The CubeSat ground station and the encryption keys may be physically secure, but connections to wireless networks and internet connections may leave the door open to hackers. The CubeSat operators should ensure that they implement the proper security measures to protect their authority to command their spacecraft. The operator should ensure that critical systems are disconnected from any unsecure networks or information storage devices. It may be insufficient to only disconnect the hardware during 140

165 command transmission. Suppose a crafty hacker were to place a file on the computer which sends commands at a later time without requiring a link to the hacker. Also noted earlier, when remote or partnered ground stations are used, not only do those ground stations require a sufficient level of security, but the connection between the stations must be secure. Operators should be very careful when connecting command centers using internet links. Personnel Security Personnel that are given access to the hardware should be trustworthy. This may call for personnel vetting procedures in certain cases. CubeSat operators may choose to limit access to only a portion of their team. In order to prevent any single person from sending commands, the operator may choose to implement a two-man rule. For example the encryption hardware or software could require a secret PIN from at least two authorized personnel before commands can be sent. An outsider would then need to acquire the PIN of two team members before sending commands. This measure would also reduce the risk of an inside job. Situational Awareness CubeSat operators who regularly communicate with their spacecraft and receive frequent tracking updates from the JSpOC can more quickly identify when control of their satellite has been compromised. If tracking data shows that the satellite trajectory has changed unexpectedly, the operator can begin assessing the situation. This is another reason why communication with the JSpOC is very important to orbital safety. End-of-Life: Passivation Many propulsion architectures rely on the storage of pressurized propellants. Some of these propellants also possess significant amounts of chemical energy. One could imagine a scenario where such a system undergoes an explosion during orbital operations. Suppose, for example, that a piece of orbital debris collides with a CubeSat, impacts the propellant tank, and 141

166 causes an explosion. This potential hazard exists throughout the mission as long as energetic propellant is stored or as long as any fluids are contained at pressure. Some amount of risk may be necessary during the mission, but at the End-of-Life (EOL) there is no use in storing chemical and physical energy. Energetic and pressurized propellants carry no redeeming value after the mission ends. AFSPCI places emphasis on the requirement for safing a spacecraft at EOL, as discussed in more detail in the section titled Satellite Disposal in Chapter III of this document. In particular AFSPCI suggests that safing the satellite takes precedence over all other disposal actions (AFSPCI , 2009, p. 13). Potential Methods of Passivation This potential hazard calls the implementation of passivation procedures to be carried out at EOL. There are several ways in which a CubeSat operator may passivate their satellite. The procedure used depends on the mission and the propellant. Propellant Venting First, at EOL the CubeSat could vent all remaining propellant by executing a de-orbit maneuver or by venting the propellant directly into space through an un-choked valve. AFSPCI Section requires of Air Force missions, the [Space Wings] will deplete all spacecraft fuel to the maximum extent possible (AFSPCI , 2009, p. 13). The CubeSat developer should consider what risk the vented propellant may pose. For example, if the propellant is expected to condense or freeze before full dispersion, the operator may prefer to burn the remaining propellant rather than allow the frozen or condensed propellant to become orbital debris. A resourceful CubeSat operator may choose to use the remaining propellant to perform a de-orbit maneuver. This would render the spacecraft inert while decreasing its remaining orbital lifetime. After all, at EOL the CubeSat becomes orbital debris until reentry. 142

167 Chemical Inhibition The CubeSat developer may consider rendering their propellant inert through the use of chemical inhibits. The author is unaware whether this is possible, but wishes to propose the idea. Consider mono-propellant propulsion systems which rely on catalysts to induce decomposition of the propellant. With sufficient energy dissipated during an orbital debris impact, the propellant could theoretically combust without the catalyst. The probability of combustion may be reduced if an inhibiting chemical were injected into the reservoir at EOL. The author is currently unaware if such a chemical exists for any particular propellant. End-of-Life: De-orbit and Re-entry Orbital Lifetime Assessment Spacecraft can be disposed of in more than one way. First, satellites in Low Earth Orbit (LEO) may de-orbit when they succumb to atmospheric drag at the end of a mission. At higher orbits, there are more convenient options which require less propellant. As one option, according to NASA STD Section 4.6.2, spacecraft can enter a disposal orbit with a perigee greater than 2,000 km, but with an apogee that is no greater than 500 km below geostationary orbit (GEO). Satellites are required to reenter or to enter a disposal orbit within 25 years of the end of mission, and no later than 30 years after launch (NASA-STD A: Process for Limiting Orbital Debris, 2012). NASA s DAS software, which is available at no cost at is discussed in more detail in the following section. In addition to calculating reentry survivability estimates, the software can also calculate orbital lifetimes for spacecraft, given the average cross-sectional area to mass ratio. The software even includes a tool which helps to calculate the cross-sectional area of a three-dimensional spline defined by the user (Opiela, Hillary, Whitlock, & Hennigan, 2012) 143

168 Since CubeSat operators have traditionally not possessed the means to change their spacecraft s trajectory, they have had to rely on passive methods of losing altitude to reenter the atmosphere. Essentially, this means that CubeSats have been deployed in low enough orbits so that atmospheric drag causes reentry to occur within 25 years. This has limited the number of acceptable launches for CubeSats. However, with the dawn of CubeSat propulsion systems, CubeSat missions may begin to take advantage of launch opportunities at higher altitudes. At EOL, the CubeSats can be maneuvered in to disposal orbits or into orbits with shorter lifetimes. If a CubeSat operator intends on using their propulsion system to dispose of their satellite, they must have the means to manage their onboard resources. Once the propellant quantity drops near the amount required for the disposal maneuver, the operator must initiate disposal and safing procedures. Tank Material and Orbital Debris Assessment Report The CubeSat Design Specification (CDS), section , requires that Aluminum 7075 and 6061 be used for the main CubeSat structure (CubeSat Design Specification Rev. 12, 2009). However, Aluminum is often less suitable for pressure-bearing components such as pressure vessels, tubing, and valves. Steel and Titanium alloys often carry advantages for propellant tanks. Unfortunately, these materials may present a certain hazard during reentry that Aluminum alloys generally do not. Aluminum tends to break-up, melt, and vaporize during atmospheric reentry. Steel and Titanium alloys, however, may survive reentry and impact the earth with significant kinetic energy. If a component survives reentry with enough kinetic energy, the impact may cause casualties. Non-Federal Spacecraft. For non-federal spacecraft operators, the Federal Communications Commission (FCC) frequency license application process requires submittal of information concerning orbital debris mitigation. According to an FCC public notice, an Orbital Debris Assessment Report (ODAR), as 144

169 described by NASA standards, should satisfy the information submittal requirements (Federal Communications Commission, 2013). However, beyond documentation, compliance with the NASA orbital debris mitigation requirements may not fully satisfy the requirements of the FCC. NASA-STD Process for Limiting Orbital Debris describes the analysis and requirements needed to complete an ODAR. Section Requirements for the Area, includes requirements for limiting the risk of casualty during reentry. Paragraph states, the potential for human casualty is assumed for any object with an impacting kinetic energy in excess of 15 joules. In other words, any object that can strike the ground with more than 15 joules of kinetic energy after reentry can cause a human casualty. For uncontrolled reentries, paragraph a requires that the risk of human casualty be no greater than , or one in 10,000. NASA provides free software, available online, that can be used to calculate the risk of human casualty for individual objects and composite objects, as discussed below (NASA-STD A: Process for Limiting Orbital Debris, 2012).While a CubeSat design might satisfy the safety envelope described in NASA-STD , the FCC may impose further requirements in order to handle the risk of components that survive reentry. The reader is encourage to download NASA s Debris Assessment Software (DAS), which is available at no cost from The Casualty Risk from Reentry Debris tool allows the user to input object materials, quantities, material types, shapes, thermal mass, and dimensions. The orbital inclination angle is also required. Given those inputs, the model predicts the demise altitude, total debris casualty area, and kinetic energy for each object, and the mission s risk of human casualty (Opiela, Hillary, Whitlock, & Hennigan, 2012). If the software predicts potential non-compliance with the requirements given in NASA-STD , the developer may use another software package called the Object Reentry Survival Analysis Tool (ORSAT) for a higher fidelity assessment (Orbital Debris ORSAT, 2009). 145

170 If a component of a CubeSat survives reentry with at least 15 joules of kinetic energy and a probability of human casualty greater than zero, the FCC requires justification and insurance appropriate to the risk (Federal Communications Commission, 2013). In the event an assessment of the spacecraft re-entry finds surviving materials presenting a casualty risk other than zero, the applicant should provide in its application a detailed discussion of the need for use of high melting point materials, demonstrating that mission objectives cannot be met with an alternative spacecraft design. The FCC considers insurance arrangements as a relevant consideration if the satellite will be disposed of by atmospheric re-entry, with portions of the satellite expected to survive re-entry. Therefore, the application should also identify steps taken or to be taken to obtain an insurance policy listing the United States as an insured party or additional insured party, and demonstrating that the policy will provide adequate coverage. Consistent with NASA Standards, the FCC staff considers objects surviving re-entry with less than 15J energy as not presenting a cognizable casualty risk. (Federal Communications Commission, 2013) CubeSat providers should design their systems so that the pieces surviving reentry do not impact with greater than 15 joules of kinetic energy. If the mission cannot be accomplished under such a requirement, the CubeSat provider will need to apply for a waiver and offer compelling rationale for allowing a risk of casualty and the CubeSat provider will need to obtain adequate insurance to cover protecting the United States (Federal Communications Commission, 2013). The requirements proposed in this document do not permit a reentry casualty hazard. Any CubeSat designer that wishes to use high melting-point materials would need to seek a waiver in addition to following the steps outlined by the FCC. 146

171 Federal CubeSats. Developers of federal CubeSats, including those funded United States Department of Defense, may obtain their frequency license by working with their respective spectrum management office and the National Telecommunications and Information Administration (NTIA), who may or may not require submittal of an ODAR. Having said this, all CubeSat operators are encouraged to respect the universal responsibility to never present undue risk to human life. Again, the requirements proposed in this document do not permit a reentry casualty hazard. Any CubeSat designer that wishes to use high melting-point materials would need to seek a waiver. 147

172 VIII. PROPOSED STANDARDS Disclaimer At this time, any standards or requirements that are proposed in this document are in draft form and should not be used for mission planning purposes without consultation with the launch provider or the auxiliary payload integrator. The author hopes that the reader will find the discussions contained in this document useful as he or she assess the risks associated with their particular mission. For updates regarding the release of standards and requirements related to the CubeSat Design Specification (CDS), visit the Cal Poly CubeSat Program s website, APPENDIX B contains a draft of the proposed safety standards at the time of this publication. This chapter summarizes the rationale behind each standard that is proposed. For convenience, the text for each standard is given in full throughout the chapter. Fault Tolerance and Inhibits The standards begin with some guidance on proper assessment of hazard severity and the necessary fault tolerance. These particular concepts are discussed in detail in Chapter IV CONCEPTS IN SYSTEM SAFETY. These concepts are not unique to propulsion systems and are appropriately applied to the containment of all hazards including radio transmitters, electrical power systems, deployables, etc. First, Standard 1.1 offers a definition for credible and non-credible hazards, as is discussed in Chapter IV in the section titled Non-Credible Hazards. A non-credible hazard is simply one that is infeasible or one that is contained to a degree that it will not be treated as feasible. Any hazard that is contained with dual-fault tolerance is considered non-credible. As Standard 1.3 states, the required fault tolerance for containing a hazard depends on the severity of that hazard. When a CubeSat designer can protect against a hazard with dual-fault tolerance, they may save a significant amount of cost since that hazard, being non-credible, does 148

173 not need to be evaluated for hazard severity. Dual-fault tolerance sufficiently protects against even catastrophic hazards. 1.1 Any potential hazard that is contained with dual-fault tolerance using at least three independent inhibits shall be identified as non-credible. Potential hazards that are deterministically shown to be infeasible shall also be identified as non-credible. All other potential hazards shall be identified as credible. Hazards need not exist for their own sake. No logical designer would knowingly increase risk without a reason. For every hazard, there must be some benefit which requires the additional risk. If a potential hazard is to be accepted, the benefit should outweigh the risk. There should also be no other less-hazardous options available that is adequate than the one taken. 1.2 When the mission can be accomplished without imposing a hazard, the hazard shall be avoided. The CubeSat provider shall be prepared to defend the existence of any hazard that cannot be eliminated. The rationale shall match the gravity of the potential hazard. When a potential hazard cannot be avoided, it still must be contained. As mentioned above, the required fault tolerance needed to contain each credible hazard depends on the hazard severity, as discussed in Chapter IV. This concept is addressed in AFSPCMAN Vol. 1 Figure 3.2 (AFSCMAN Vol. 1, 2004). Inhibits are devices that interrupt the potential for a hazard, as discussed in Chapter IV in the section titled Inhibits. Each additional independent inhibit that is added to protect against a hazard increases fault tolerance by one. Inhibit independence is also discussed in Chapter IV. 149

174 1.3 The severity of each credible hazard shall be assessed as either negligible, marginal, critical, or catastrophic, according to the potential consequences, as defined in AFSPCMAN Vol. 1 Figure All catastrophic hazards shall be contained with dual-fault tolerance using at least three independent inhibits All critical hazards shall be contained with single-fault tolerance using at least two independent inhibits All marginal and all negligible hazards shall be contained with at least one inhibit No structural failure, given an adequate design margin, shall be regarded as a single point of failure. Propulsion System General Requirements Propulsion systems represent a diverse range of hazards which depend on several factors such as the system performance and the propellant selected. In order to address safety concerns as early as possible, it is important for the CubeSat provider to communicate with the launch integrator or launch provider. 2. Propulsion System General Requirements. The CubeSat provider shall provide a Propulsion System Summary Sheet (PSSS) to the launch integrator and the launch provider. The PSSS shall include a schematic and a description of the system performance limits, the propellant and its containment system, hazards, inhibits, and inhibit controls. The CubeSat provider shall follow the format given below. See APPENDIX B for the format and example. The format was consolidated to fit on one page in order allow for the initial dialogue to begin without delay. A larger document could delay the reception of important information about the propulsion system. More detailed information 150

175 can be collected later in the process in order to prepare the Missile System Prelaunch Safety Package (MSPSP) for Range Safety. Range Safety Standards Most of the Range Safety standards are derived directly from AFSPCMAN An effort is made to help the CubeSat developer to understand which sections are applicable to their particular mission. Chapter V RANGE SAFETY discusses the concepts that are contained in these standards. Chapter VI RANGE SAFETY CASE STUDIES walks through a set of case studies in which the hazards of hypothetical propulsion system architectures are identified and evaluated. Each hypothetical system was reviewed by Range Safety and a likely path toward flightworthiness, according to these standards, are given. CubeSat developers may find it helpful to review the set of case studies in order to gain an understanding of the intent and application of these standards. After doing so, the CubeSat developer should be better able to navigate their trade space by making realistic predictions of the path toward flightworthiness for the particular propulsion systems they may be considering. Hazardous Materials It is necessary to consider how to handle hazardous material since some propulsion systems use hazardous materials as their propellants. The section titled Hazardous Material in Chapter V discusses hazardous material in more detail. First, it is useful to define hazardous material. Simply, a hazardous material is any material that can cause a hazard to exist. Standard 3.1 proposes a definition for hazardous material in an attempt to catch every case. 151

176 3.1 Hazardous Material Requirements. These requirements apply to any system that contains materials that are either flammable, explosive, energetic, toxic, or otherwise hazardous, on their own or in interaction with other materials in the expected environments under environmental conditions expected from ground operations through CubeSat deployment. The following standards provide a starting point. First, Standard suggests that a hazard should be avoided when possible. When a hazard must be tolerated, Standard requires that the CubeSat provider notify the integrator, the launch provider, and Range Safety The CubeSat design shall use the least hazardous material that satisfies the mission requirements The CubeSat provider shall be prepared to justify the use of any hazardous material. The rationale shall match the gravity of the potential hazards The CubeSat provider shall declare to the integrator, the launch provider, and Range Safety, any potentially hazardous material present on their satellite at the earliest time possible in order to allow sufficient time to address any concerns before integration. This will improve the chances that the CubeSat will eventually demonstrate a level of safety acceptable for flight. The CubeSat provider shall also provide a Material Safety Data Sheet (MSDS) or a Safety Data Sheet (SDS) for each potentially hazardous material. Standard speaks to the reality that CubeSats are not accessible after integration to the P-POD. The CubeSat designer should take into account the amount of time the CubeSat will be in storage prior to launch, without access. 152

177 3.1.4 All flight materials, including propellants, shall be contained within the CubeSat prior to P-POD integration. After integration, the CubeSat provider will have no access to their satellite. While the CubeSat program wishes to be transparent in a way that the primary mission operations and schedule are unaffected by the presence of the CubeSats, hazardous materials may demand extra care. The CubeSat operator may need to work with the integrator, launch provider, and Range Safety to provide provisions such as shipping containers and leak sensors The CubeSat provider shall work with the integrator, the launch provider, and Range Safety to coordinate any special provisions needed for the safe and legal transport and storage of any materials onboard the CubeSat. For example, special provisions may include equipment and procedures needed for atmospheric monitoring and leak detection or certified shipping containers. See AFSPCMAN Vol. 6 Section The presence of hazardous materials affects how pressure systems are treated by Range Safety. The following section outlines requirements which are specific to pressure systems containing hazardous materials or non-hazardous materials. Pressure Systems The CubeSat developer is directed to the general requirements from AFSPCMAN which pertain to all systems which include pressure systems or other fluid containment systems. 3.2 Pressure Systems and Fluid Containment Systems General Requirements. Satellites containing pressure systems shall comply with AFSPCMAN Vol. 3 Sections 12.1 and Also see AFSPCMAN Vol. 3 Attachment 1 for additional guidance in preparing the Missile System Prelaunch Safety Package (MSPSP). 153

178 The Missile System Prelaunch Safety Package (MSPSP) is a document that is submitted to Range Safety which documents that the system has met an acceptable level of safety. CubeSat providers produce an MSPSP for each CubeSat satellite. Propellant and Pressure System Design Requirements Pressure vessel design and verification is emphasized in AFSPCMAN Vol. 3 Chapter 12 (AFSPCMAN Vol. 3, 2004). These requirements are discussed in Chapter V RANGE SAFETY in the section titled Pressure Systems. The route toward flightworthiness can take several paths depending on the pressure vessel material, the material contained within the vessel such as the propellant, and the failure mode of the vessel. The applicability of the requirements given in AFSCPMAN Vol. 3 Chapter 12 are summarized in Table 4 on in Chapter V of this document. Standard directs the CubeSat developer to the general requirements that apply to all propellant reservoirs and pressure vessels Satellites containing a pressure vessel or reservoir shall comply with AFSCPMAN Vol. 3 Section which describes the required stress analysis. Since CubeSats which fly as secondary payloads must pose no significant requirements on the primary mission, CubeSats must be designed for long periods of storage. CubeSats are often integrated months prior to launch. In the case where a launch date slips or is scrubbed, CubeSats must be prepared to remain safely inside the P-POD until the next launch opportunity. Some propellants may decompose during storage, such as hydrogen peroxide (H 2 O 2 ). Standard intends to prepare the CubeSat designer for the worst case storage duration. When the duration of storage is an issue, the mission integrator must be notified of any special requirements. A case study on a hydrogen peroxide monopropellant system is given in Chapter 154

179 VI RANGE SAFETY CASE STUDIES in the section titled Case 2: Monopropellant, Hydrogen Peroxide Pressure vessels and sealed containers containing a propellant that decomposes or otherwise builds up pressure during storage shall be designed with a Maximum Expected Operating Pressure (MEOP) as the maximum equilibrium pressure at which pressure rise ceases or shall be designed for the maximum feasible pressure built up after being stored until a date 18 months past the latest planned launch date. The launch integrator (Cal Poly, for example), shall be notified if any components have a limited safe storage life. While AFSPCMAN Vol. 3 tends to require a burst factor of at least 1.5 for all pressure vessels and sealed container, a more conservative requirements is given in Vol. 6 Section That requirement requires pressure vessels which contain hazardous propellant to maintain a burst factor greater than 2 during transportation or ground handling operations. CubeSats are always integrated to the P-POD prior to integration to the launch vehicle. Therefore, all CubeSat pressure systems and propellant reservoirs which contain hazardous materials must be design with a burst factor of 2 or greater while all other pressure vessels and propellant reservoirs may be designed with a burst factor of 1.5 or greater (AFSPCMAN Vol. 6, 2004) If the contents of a pressure vessel or sealed container may pose a hazard to personnel or equipment including flight hardware in the event of a leak, burst, or spill, or if the pressure vessel or container exhibits a brittle failure mode, it shall have a burst factor of

180 3.3.4 If the contents of a pressure vessel or sealed container will not pose a hazard in the event of a leak, burst, or spill, and the failure mode is leak-before-burst (LBB), that pressure vessel or sealed container shall have a burst factor of 1.5. Pressure Vessel and Propellant Reservoir Verification Paths Standards through pertain to the verification of pressure vessels and propellant reservoirs. Specifically, the requirements describe the analysis and tests that are needed to prove the flightworthiness of pressure vessels and propellant reservoirs. These requirements are discussed in greater detail in Chapter V in the section titled Pressure Vessel Verification. The requirements are also summarized in Table 5 through Table 7 in Chapter V. Standard offers standards for metallic pressure vessels and reservoirs by pointing the CubeSat developer to the relevant sections of AFSPCMAN Vol. 3 Chapter 12. The exact requirements that are applicable depend on the failure mode of the pressure vessel and whether a leak would create a hazardous situation. AFSPCMAN discusses two paths that could be taken. A pressure vessel exhibiting a brittle fracture or when leakage of the contents would create a hazardous situation must follow path 2, as described in Standard If a pressure vessel exhibits a Leak-before-burst (LBB) failure mode and the contents are not hazardous, the pressure vessel may be subject to either path 1, as described in Standard , or path 2, depending on the preference of the CubeSat provider. (AFSPCMAN Vol. 3, 2004) Metallic Pressure Vessels and Reservoirs Satellites containing a metallic pressure vessel or reservoir shall comply with AFSPCMAN Vol. 3 Sections 12.1 and Any satellite containing a metallic pressure vessel or reservoir that exhibits a LBB failure mode and leakage of the contents cannot create a hazardous situation shall comply with AFSPCMAN Vol. 3 Sections and which 156

181 describe the requirements for Verification Approach A, Path 1. The satellite provider may choose to follow Path 2 instead by complying with Sections and Any satellite containing a metallic pressure vessel or reservoir that exhibits a brittle failure mode or where leakage of the contents could create a hazardous situation shall comply with AFSPCMAN Vol. 3 Sections and which describe the requirements for Verification Approach A, Path Any satellite containing a metallic pressure vessel or reservoir designed using ASME Boiler and Pressure Vessel Code or the DOT Pressure Vessel Codes shall comply with AFSPCMAN Vol. 3 Section which describes Verification Approach B. As Standard gives requirements for metallic pressure vessels, Standard gives requirements for Composite Overwrapped Pressure Vessels (COPV). As with metallic pressure vessels, COPVs verification requirements also fall into two paths Composite Overwrapped Pressure Vessels (COPV) and Reservoirs Any satellite containing a composite overwrapped pressure vessel or reservoir shall comply with AFSPCMAN Vol. 3 Sections and Any satellite containing a composite overwrapped pressure vessel or reservoir that exhibits a LBB failure mode and leakage of the contents cannot create a hazardous situation shall comply with AFSPCMAN Vol. 3 Sections which describes the requirements for Verification Approach A, Path Any satellite containing a composite overwrapped pressure vessel or reservoir that exhibits a brittle failure mode 157

182 or where leakage of the contents could create a hazardous situation shall comply with AFSPCMAN Vol. 3 Sections which describe the requirements for Verification Approach A, Path Any satellite containing a metallic pressure vessel or reservoir designed using ASME Boiler and Pressure Vessel Code or the DOT Pressure Vessel Codes shall comply with AFSPCMAN Vol. 3 Section which describes Verification Approach B. Standard provides a similar treatment for Sealed Containers as for metallic and COPV pressure vessels. The requirements in AFSPCMAN Vo. 3 concerning sealed containers are intended for items such as electronics boxes and reaction wheel assemblies. However, some propellants with low vapor pressures may be treated as sealed containers rather than pressure vessels, as with the hypothetical electrospray propellant reservoir discussed in Chapter VI RANGE SAFETY CASE STUDIES in the case study titled Case 7: Electrospray, Gallium. In some cases, classification as a sealed container may reduce the verification requirements somewhat. However, if the sealed container exhibits a brittle failure mode or contains a hazardous material, then that sealed container is subject to the same requirements as a pressure vessel containing a hazardous material or exhibiting brittle failure. Indeed, the sealed container in the case study cited above contains Gallium and must meet the requirements for a pressure vessel containing a hazardous material Range Safety may allow certain propellant reservoirs which operate at low differential pressures to be treated as sealed containers Any satellite containing a sealed container that exhibits a LBB failure mode and leakage of the contents cannot create a hazardous situation shall comply with AFSCPMAN Vol. 3 Section

183 Any satellite containing a sealed container that exhibits a brittle failure mode or where leakage of the contents could create a hazardous situation shall comply with AFSPCMAN Vol. 3 Section and Pressure System Components In addition to pressure vessels, all pressure components must be subject to safety requirements, as discussed in Chapter V RANGE SAFETY in the section titled Hazardous Pressure System Components. Standard 3.4 directs the reader to the applicable sections of AFSPCMAN Vol Pressure System Components. Satellites containing hazardous pressure system components shall comply with AFSCPMAN Vol. 3 Section Systems Not Currently Supported The CubeSat program currently does not foresee any hypergolic nor cryogenic propulsion systems in the near future, as is discussed in Chapter V RANGE SAFETY, in the section titled Omitted Sections from AFSPCMAN It would be challenging to prepare CubeSats to fly with monopropellant systems. Hypergolic systems are a step farther than monopropellant systems in every hazard category. Cryogenic systems require a significant amount of maintenance that is not possible within the CubeSat specification. In order to invest more time in systems that are upand-coming, the author did not study hypergolic and cryogenic systems in depth. For completeness, the author recommends publishing a standard to declare that Cal Poly does not intend to support such systems. Cal Poly does not wish to limit progress in the CubeSat community. If a CubeSat developer believes they can find ways to safely implement hyperbolic or cryogenic systems, they should contact Cal Poly. 159

184 3.5 Hypergolic and Cryogenic Systems. (Not currently supported by Cal Poly) Satellites containing cryogenic systems are not currently supported by Cal Poly. Contact Cal Poly if you wish to launch such a cryogenic system. The CubeSat provider may reference AFSCPMAN Vol. 3 Sections 12.8 and for requirements that are generally applied to hypergolic flight hardware systems Satellites containing cryogenic systems are not currently supported by Cal Poly. The CubeSat provider should understand that CubeSats are often integrated to the launch vehicle months ahead of the launch date. During this time, the CubeSat provider will have no access to their satellite. Contact Cal Poly if you wish to launch such a cryogenic system. The CubeSat provider may reference AFSPCMAN Vol. 3 Sections 12.9 and for requirements that are generally applied to cryogenic flight hardware systems. Orbital Safety Standards The topic of orbital safety is discussed in detail throughout Chapter VII ORBITAL SAFETY. The requirements begin with a statement encouraging CubeSat operators to adhere to the following requirements for the good of the entire CubeSat community. 4 Orbital Safety Standards. Adherence to these orbital safety standards will support the CubeSat community s reputation for good citizenship among the greater space community. Deviations from these requirements may jeopardize future launch opportunities for the CubeSat community which relies on the good will of organizations such as launch providers, primary satellite providers, and Range Safety 160

185 Command Security While non-propulsive CubeSats are confined to the free-fall trajectory that results from deployment form the CubeSat, those with propulsion systems possess the ability to alter their trajectory. CubeSat operators can command their spacecraft to conduct maneuvers. However, third party entities with malicious intent may attempt to hijack these CubeSats and to use their propulsion systems to do harm to other missions. This calls for CubeSat operators to consider options to improve Command Security. The factors which contribute to hijacking as well as possible solutions to prevent such events are discussed in Chapter VII in the section titled Command Security If the CubeSat contains a propulsion system, the CubeSat provider shall establish a Command Security plan which provides adequate protection against hijacking of the propulsive capabilities, proportional to the capability of the CubeSat to intercept another spacecraft The Command Security plan shall protect against the transmission of malicious commands by unauthorized ground stations, by intruders who gain access to authorized ground stations, by hackers operating over unsecure networks such as the internet, and potentially by members of the team acting alone The CubeSat provider may consider using software or hardware encryption for command transmissions, secure and monitored entrances to the command center, personnel vetting procedures, the two man rule, and limited access to encryption keys and command protocols The CubeSat operator should exercise extreme caution whenever using remote or partnered ground stations. NASA spacecraft have historically been hijacked by hackers operating over the internet between remotely connected ground stations. 161

186 Close Proximity Operations with Host Vehicle Immediately after separating from the host vehicle at P-POD deployment, a CubeSat propulsion system may present a hazard to the host vehicle. Suppose that a propulsion system were to burn in such a way that the spacecraft entered a trajectory in which it returned and collided with the host vehicle. Regardless of the performance of the CubeSat propulsion system, it should be disarmed during the first 30 minutes after separation as a minimum. This reduces the probability that any thruster plume will damage the host vehicle In order to mitigate the possibility of thruster plume impingement on the host vehicle, and in order to improve separation from other CubeSats, the propulsion system shall be disarmed by at least one independent inhibit for the first 30 minutes after separation. Note that the launch provider may impose a longer delay or other criteria that must be met before propulsion systems may be armed. In addition to the host vehicle, other CubeSats may contain equipment such as optics, which are sensitive to thruster plumes. The CubeSat operator will need to coordinate with the launch integrator or launch provider to address this potential hazard. Collision between CubeSats is also a concern. In some cases, activation of the propulsion systems may need to wait until accurate orbital tracking data becomes available The CubeSat operator shall coordinate with the launch integrator or launch provider to determine when the CubeSats are sufficiently separated to allow thruster operation. This decision shall consider the potential for plume impingement and collision between CubeSats. After the initial delay time of 30 minutes, the CubeSat propulsion system may be used if the performance of the system is insufficient to place the CubeSat in a collision trajectory with 162

187 the host vehicle. The CubeSat is assumed to be in close proximity operations for the duration of one week after deployment. During this time, the CubeSat should not arm its propulsion system until it has drifted far enough away that an erroneous burn which uses all of the propellant cannot cause the CubeSat to return and collide with the host vehicle Within the first week after deployment, if the CubeSat satellite can feasibly return and collide with the host vehicle in one pass, the propulsion system shall be disarmed by at least one independent inhibit until the CubeSat can no longer feasibly return and collide with the host vehicle. The criteria which predict the feasibility of a collision are given in Standards through The section in Chapter VII titled Collision with the Host Vehicle discusses the analysis which was used to determine a safety envelope within which a CubeSat cannot return and collide with the host vehicle within one pass. The V required to intercept the host vehicle increases after each orbit by an amount equal to the portion of the separation velocity that is parallel to the orbital velocity. This linear trend is useful during the first 100 orbital periods since separation, which corresponds to approximately one week in LEO, and the trend is largely independent of separation velocity, the direction of separation, orbital altitude, eccentricity, and the orbital location at separation In the short term, the V required for the CubeSat to collide with the host vehicle is greater than 90% of the product of the tangential portion of the separation velocity (~1 m/s) and the number of orbits since separation. ( V for Collision) > 0.9 * (Tangential Separation Vel.) * (Periods Since Separation) Standard offers a criteria which compares the total feasible V attributed to the propulsion system with the V required at a specific time for collision. Once the V required for 163

188 collision has grown beyond the feasible V, a collision is no longer feasible and the propulsion system may be activated A CubeSat cannot feasible return and collide with the host vehicle within one pass in the short term if 90% of the required V for collision, as given in , has grown beyond the maximum feasible V the propulsion system can generate. If the criteria given in Standard has not yet been met, the CubeSat operator may activate their propulsion system after 30 minutes from deployment if the thrust to weight ratio of the CubeSat is sufficiently small so that the propulsion system cannot overcome the orbital drift which drives the CubeSat and host vehicle apart A CubeSat cannot feasibly return and collide with the host vehicle within one pass in the near term if the satellite satisfies this inequality expression. This expression compares the maximum feasible acceleration produced by the CubeSat with 90% of the growth rate for the V required to enter a collision course, which is approximately the CubeSat s separation velocity (~1 m/s) in the direction tangent to the orbital velocity of the host vehicle. (Max. Thrust) (Min. C.S. Mass) < 0.9 * (Tangential Separation Velocity) (Orbital Period) After one week, the CubeSat is considered to be sufficiently separated from the host vehicle and the propulsion system can be used, if not previously allowed by Standards through Throughout orbital operations, the CubeSat operator should follow general orbital safety measures and maintain communication with the JSpOC, as will be discussed later After one week has passed since CubeSat separation, the CubeSat is be assumed to be adequately separated from the host vehicle such that the requirements associated with close 164

189 proximity operations no longer apply. If not already permitted by 4.2.3, the propulsion system may be armed and operated according to general orbital safety standards. Note that the launch provider may impose other criteria that must be met before the propulsion system may be used. Trackability The section titled Trackability in Chapter VII discusses the need for a CubeSat operator to be in contact with the Joint Space Operations Center (JSpOC), which provides conjunction assessment, collision avoidance, and tracking data for space objects. It is in the CubeSat operator s best interest to collaborate with the JSpOC to determine a safe concept of operations. The CubeSat provider should establish first contact with the JSpOC by working with their launch provider to submit an Orbital Data Request (ODR). That establishes a direct two-way communication pipeline between the CubeSat operator and the JSpOC If the CubeSat contains a propulsion system of any kind, including solar sails, the operator shall work with the Joint Space Operations Center (JSpOC), operated by the Joint Functional Component Command for Space (JFCC SPACE), to establish a Conjunction Assessment and Collision Avoidance plan. The CubeSat operator can establish communication with JFCC SPACE by working with their launch provider or launch integrator to submit an Orbital Data Request (ODR) form to ODR@space-track.org. The ODR and instructions are available online at The CubeSat operator should also request an account with For reference, see AFI , especially section 5.9. Certain steps can be taken to help the JSpOC to more easily track CubeSats. Active transponders can help the JSpOC to easily find CubeSats and distinguish them from space debris and from other CubeSats. Passive Radio-Frequency Identification (RFID) reflectors are strongly 165

190 recommended since they do not require battery power. This allows the JSpOC to more easily track CubeSats after the end of mission in order to predict collisions with still-operating spacecraft If the CubeSat contains a propulsion system of any kind, including solar sails, the design shall also include active or passive RF identification reflectors or transponders. This will help the JSpOC to provide more effective tracking data and will aid in predicting orbital conjunctions with other objects. Passive devices are preferred over transponders as they do not rely on the satellite s power system While the proposed standards require that all propulsive CubeSats implement RF identification reflectors or transponders, it is strongly recommended that all CubeSats introduce such devices into their designs. The entire orbital community will benefit from the improved level of safety All CubeSat developers are encouraged to implement active or passive RF identification reflectors or transponders as discussed in standard of this document. This will help the JSpOC to provide more effective tracking data to the CubeSat. Passive devices are preferred over transponders as they do not rely on the satellite s power system End-of-Life (EOL) Safing, Passivation, and Disposal In Chapter VII ORBITAL SAFETY, the section titled End-of-Life: Passivation and the section titled End-of-Life: De-orbit and Re-entry discusses some important End-of-Life (EOL) procedures which help to mitigate the growing problem of man-made space debris. Many of these requirements are outlined in AFSPCI (AFSPCI , 2009). It is critical that CubeSats meet their requirement to de-orbit within 25 years of the end of their mission, and within 30 years of launch (NASA-STD A: Process for Limiting Orbital 166

191 Debris, 2012). Standard addresses the importance of disposal. When a propulsive maneuver is necessary in order to meet that requirement, the CubeSat operator is responsible for budgeting their propellant and other resources so that the maneuver can be executed successfully before the propellant is depleted If a propulsive maneuver is necessary to de-orbit within 25 years, the CubeSat operator shall initiate End-of-Life (EOL) procedures when the onboard resources reach the minimum required for safe disposal and passivation. In order to prevent the generation of orbital debris due to explosions, all pressure systems should be vented at EOL. One way of venting propellant is to use up the entire propellant supply in a disposal maneuver In order to prevent the creation of new space debris resulting from explosions, at EOL the CubeSat operator shall depressurize all pressure systems and vent all remaining propellant. While both safing and disposal activities are important, AFSPCI Section prioritizes safing procedures over disposal procedures (AFSPCI , 2009). Standard in this document communicates the same order of priority as AFSPCI In keeping with the priorities given in AFSPCI Section , safing the satellite shall take precedence over all other disposal actions. Re-entry Survivability Each non-military CubeSats developer must work with the FCC to obtain their frequency licenses. As discussed in Chapter VII, FCC policies require that the satellite provider submit a document outlining reentry survivability analysis. According to a public notice published by the FCC, CubeSat components may not be launched which will survive reentry with kinetic energy of 167

192 15 J or greater. Impacts of less than 15 J are not expected to result in casualty (Federal Communications Commission, 2013) Re-entry Survivability: CubeSats providers shall coordinate with their frequency license authority to respond to reentry hazards. When the FCC is the licensing agency, the CubeSat shall contain no components which will survive reentry through the atmosphere with a kinetic energy of 15J or greater. Compliance with this requirement reduces the possibility of casualty due to debris impact. See this public notice from the FCC: 168

193 IX. CONCLUSION The CubeSat community has begun to develop and implement propulsion systems. This movement represents a new capability which may satisfy mission needs such as orbital and constellation maintenance, formation flight, de-orbit, and even interplanetary travel. With the freedom and capability granted by propulsion systems, CubeSat providers must accept new responsibilities in proportion to the potential hazards that propulsion systems may present. Propulsion systems may carry hazardous materials which can be explosive, toxic, flammable, corrosive, etc. Propellant containment systems such as pressure vessels carry the risk of burst. Upon separation from the host vehicle CubeSats must be designed so that they cannot return and collide with their host. During orbital operations, CubeSat operators must be careful to protect against collision with other objects, especially occupied spacecraft such as the International Space Station (ISS). Finally, at End-of-Life (EOL), a CubeSat must be placed into a safe state in a disposal orbit, or they must safely reenter the atmosphere. The Cal Poly CubeSat program publishes and maintains the CubeSat Design Specification (CDS). They wish to help the CubeSat community to safety and responsibly expand its capabilities to include propulsive designs. For this reason, the author embarked on the task of developing a draft of safety standards for CubeSat propulsion systems. Wherever possible, the standards are based on existing documents. Chapter III introduces some of the documents that were used. These documents are published by entities such as the Cal Poly CubeSat program, NASA, and the Air Force. In Chapter IV, the author provides an overview of certain concepts in systems safety with respect to the classification of hazards, determination of fault tolerance requirements, and the use of inhibits to satisfy fault tolerance requirements. Depending on the severity of a hazard being contained, a CubeSat design may be required to demonstrate no-fault tolerance, single-fault tolerance, or dual-fault tolerance. 169

194 Chapter V discusses range hazards that could exist from ground operations through launch with respect to hazardous materials and pressure systems. Most of the standards relating to Range Safety are drawn from AFSPCMAN Range Safety, part of the U.S. Air Force Space Command, provides very detailed guidance for verifying pressure vessels. Pressure vessels designed for leak-before-burst (LBB) which containing non-hazardous fluids can be verified using verification path 1. Pressure vessels that exhibit the brittle fracture failure mode or contain hazardous fluids, must follow verification path 2. Sealed containers are treated in a similar way (AFSPCMAN Vol. 3, 2004). All pressure vessels or sealed containers containing non-hazardous materials must satisfy a burst factor of 1.5 or greater. During ground operations such as transportation, pressure vessels and sealed containers which contain hazardous materials must satisfy a burst factor of 2.0 or greater. Since CubeSats are transported after integration, any CubeSat pressure vessel or sealed container containing a hazardous fluid or exhibiting a brittle fracture failure mode must have a burst factor of 2.0 or greater (AFSPCMAN Vol. 6, 2004). Having reviewed a set of hypothetical propulsion system architectures with an engineer from Range Safety at Vandenberg Air Force Base, the author compiled a case study, which can be found in Chapter VI of this document. The hazard level of monopropellant propulsion systems can vary greatly. Generally, hydrazine propulsion systems must be protected from leak with dualfault tolerance. Green propellants such as AF-M315E, may be safe enough for containment with no-fault tolerance. Propellants such as Gallium may seem non-hazardous due to their low toxicity and low vapor pressure. However, as is the case with Gallium, leakage could cause a catastrophic hazard due to its ability to corrode soft metals such as Aluminum. While a Gallium container may be tested and analyzed as a sealed container, it may require dual-fault tolerant containment. Every propulsion system offers unique nuances. The author recommends that CubeSat developers communicate with Range Safety as early as possible in order to identify and contain hazards while design modifications are still possible. Otherwise, a CubeSat provider may find that their 170

195 propulsion system cannot meet an acceptable level of safety in time to take advantage of a launch opportunity. In Chapter VII, the author discusses many aspects of orbital safety. The author discusses the risk of collision with the host vehicle and with third party satellites along with the trackability of CubeSats that use propulsion systems. Some recommendations are given for working with the Joint Functional Component Command for Space (JFCC SPACE) which operates the Joint Space Operations Center (JSpOC), thanks to the input of two advisors who work with the JSpOC. In addition to establishing a point of contact with the JSpOC, CubeSat operators can improve orbital safety by incorporating Radio-Frequency Identification (RFID) devices into their designs. Command Security is discussed as an important aspect of a mission which implements a propulsion system. CubeSat developers are encouraged to prepare for the possibility of an attempted hijacking. They should strive to identify every entry point where someone with malicious intent could take control of the propulsive capabilities of a CubeSat. CubeSat operators should be very careful if they intend to use remote or partnered ground stations to send commands, especially when connecting the ground stations through an internet connection. The appropriate degree of protection may depend on the threat level. For example, CubeSats with very low propulsive performance may be less capable of causing harm that CubeSats with high thrustto-weigh ratios. In some cases, expensive and intrusive Command Security measures may not be necessary in order to meet an acceptable level of safety. The author discusses End-of-Life (EOL) procedures such as safing and de-orbit operations. These safety standards are intended to promote good citizenship by minimizing CubeSat missions contribution to orbital debris hazards. CubeSats which require an EOL maneuver to reach their disposal orbit may need to monitor their onboard resources such as propellant. Before the resources have depleted below the required amount, the CubeSat operator must initiate the EOL maneuver. CubeSats which contain pressure systems should also passivate their system, possibly by venting their propellant, as soon as the pressure system is no longer 171

196 needed. According to AFSPCI Section , safing the satellite shall take precedence over all other disposal actions (AFSPCI , 2009). APPENDIX B contains the current draft of the proposed safety standards at the time of this publication. In Chapter VIII the author steps through each standard and offers justification with references to other applicable sections within this document. The author is confident that these standards will set the stage for a dialogue in the CubeSat community which will lead to the formulation of a reasonable and comprehensive set of standards. The author hopes that the discussions given throughout this document help CubeSat developers to visualize the path to flight readiness so that they can begin on the right foot. Next Steps Publishing the Standards This document only proposes a draft of safety standards. None of the requirements given here are binding. In order for these standards to become publishable, they should be presented to the CubeSat Standards Committee. After discussions, and perhaps revisions, the standards should be reviewed by various launch providers. More input may be needed from Range Safety and the JFCC SPACE. When the final draft of the standards is complete, the Cal Poly CubeSat program should publish them as part of the CubeSat Design Specification (CDS) or as a supplementary document referenced by the CDS. After the standards have been published, the Cal Poly CubeSat program will be able to support self-propelled CubeSats in general, rather than in a case-by-case basis. Notify Launch Providers of Close Proximity Analysis The author recommends that launch providers should be introduced to the information contained in the section titled Collision with the Host Vehicle in Chapter VII. This information could help the launch provider to select an optimum orientation for the host vehicle during CubeSat separation. The author recommends deployments in the velocity direction, or the 172

197 negative velocity direction, in order to maximize the benefits of orbital drift. When a CubeSat has a high area-to-mass ratio, the effects of drag should be considered. For example, should a CubeSat with a drag sail deploy its sail too early, it may blow the CubeSat back to the host vehicle. For certain separation directions the drag will help to separate the CubeSat from the host vehicle, while for other separation directions the drag could blow the CubeSat back at the host vehicle. Recommendations for Research With the perspective gained in this research, the author wishes to propose topics for future research. Develop RFID Devices First, as is discussed in the section titled Radio Reflectors and RFID in Chapter VII, orbital safety could be improved through the use of Radio-Frequency Identification (RFID) devices. While each CubeSat provider may be capable of acquiring their own device, cost could be saved if a small number of organizations were to mass produce them. Perhaps the Cal Poly CubeSat program could take on this responsibility and provide the devices at a reasonable cost. Continue Close Proximity Analysis Some steps could be taken to build upon the analysis that is described in the section titled Collision with the Host Vehicle in Chapter VII. The analysis predicts safety envelopes whether a CubeSat could not feasibly return and collide with the host vehicle after separating from the P- POD. The analysis assumes that the intercept trajectory causes a collision within one pass. Lower V maneuvers may be capable of placing the CubeSat into an intercept trajectory that takes two passes, three passes, or more. Future research could use a multiple-pass Lambert s problem solver to determine the V thresholds that achieve intercept after range of delay times with varying numbers of passes. 173

198 Another research task could also spin-off from that analysis. The author did not have time or computational resources to determine the probability of collision if a CubeSat were to fire in a random direction after separation from the host vehicle. Future research could plot the probability as a function of delay time. While the deterministic analysis which has already been conducted found a safety envelope where no feasible maneuver could place the CubeSat into a single-pass collision trajectory, a probabilistic analysis could find a wider envelope where the probability of collision is sufficiently low enough to satisfy the collision probability requirements given in AFI Section 5.2. The analysis concerning collisions with the host vehicle also neglects the presence of a primary payload which might separate from the host vehicle prior to CubeSat deployment. See the section titled Analysis in Chapter VII under the heading Collision with the Host Vehicle and Figure 15. The author hypothesizes that that if the CubeSat separates from the host vehicle some time after the primary satellite has departed, the initial V required to intercept primary should be the tangential separation velocity of the primary times the number of orbital periods since separation. The V required to intercept the primary should increase after each orbit by the relative tangential separation velocities of the primary satellite and the CubeSat. Command Security More research could be done to determine the level of Command Security that is necessary to protect the control authority of propulsive CubeSats. For example, in future research one could discern the conditions when hardware encryption is necessary and when software encryption suffices. The author and an advisor attempted to obtain input from the National Security Administration (NSA). However, this had not been accomplished at the time of this publication. 174

199 Unified Orbital Safety Authority During this project, the author noticed a non-ideal situation that exists in the industry. Orbital debris mitigation is currently enforced by the Federal Communications Commission (FCC) for every non-government spacecraft that requires a transmission license. Government spacecraft, on the other hand, can obtain frequency licenses directly through the National Telecommunications and Information Agency (NTIA) and their frequency manager. The author means no disrespect to either of these organizations, but the primary charter of these organizations is not to enforce orbital safety. One could imagine a mission which requires no frequency license and slips through the cracks. Perhaps a spacecraft were to launch without a frequency license. The lack of a frequency license only prevents the spacecraft from lawfully transmitting, but not from launching. One could easily imagine such a possibility for CubeSat missions when the flight hardware is integrated months prior to launch with or without a frequency license. The author proposes that research be done to examine this condition. Perhaps orbital safety could be enforced by a different organization, even a new organization that is more directly chartered to maintain orbital safety. Perhaps the Joint Functional Component Command for Space (JFCC SPACE) or the Federal Aviation Administration (FAA) are reasonable candidates to accept this responsibility. The organization would need to be given sufficient authority to enforce orbital safety. The FCC is capable of withholding a frequency license for unsafe space systems while Range Safety can keep a spacecraft from launching when it poses excessive risk to the range. The author is unaware of any authority that can prevent a spacecraft from launching due to orbital safety hazards. Future research may consider how orbital safety can be ensured for satellites operated or launched abroad. Perhaps an international authority should take on the task of enforcing international norms of behavior for orbital operations. Perhaps this is a responsibility that could be taken on by the United Nations Office for Outer Space Affairs. 175

200 LIST OF REFERENCES Aerojet Rocketdyne. (2013, 12 07). CubeSat Modular Propulsion System Product Line. Retrieved from Aerojet Rocketdyne: AFI (2010, Feb 18). Space Safety and Mishap Prevention Program. United States: Air Force. AFSCMAN Vol. 1. (2004, Jul 1). Range Safety User Requirements Manual, Volume 1 - Air Force Space Command Range Safety Policies and Procedures. United States. AFSPCI (2009, May 15). Satellite Operations. United States: Air Force Space Command. AFSPCMAN Vol. 3. (2004, Jul 1). Range User Requirements Manual, Volume 3 - Launch Vehicles, Payloads, and Ground Support Systems Requirements. United States. AFSPCMAN Vol. 6. (2004, July 1). Range Safety User Requirements Manual. United States. Biddy, C. (2009). Monopropellant Micro Propulsion system for CubeSats. San Luis Obispo: Stellar Exploration. Burges, J. D., M. J. Hall, & E. G. Lightsey, (2012). Evaulation of a Dual-Fluid Cold-Gas Thruster Concept. World Academy of Sciences, Engineering and Technology. Busek Electrospray Thrusters. (2013). Retrieved from Busek Space Propulsion and Systems: Busek RF Ion Thruster. (2013). Retrieved from Busek Space Propulsion and Systems: Busek Space Propulsion and Systems. (2013). Busek Micro Resistojet. Retrieved from Busek.com: Case, K. (2013a, 7 12). Corresspondence. (L. Cheney, Interviewer) Case, K. (2013b, November 14). Case Study Meeting. (L. Cheney, Interviewer) 176

201 Clyde Space. (2011, August). CubeSat Pulse Plasma Thruster. Retrieved from Clyde Space: Commission, F. C. (2013, March 15). Public Notice: Guidance on Obtaining Licenses for Small Satellites. Washington, DC. Retrieved from CubeSat Design Specification Rev. 12. (2009). San Luis Obispo, Califonria: Cal Poly CubeSat Program. CubeSat Program Pictures. (2009, November 9). Retrieved from CubeSat.org: Diamantopoulos, R. C. (2013, 10 4). Correspondence. (L. Cheney, Interviewer) Diamantopoulos, R. C., & E. Quinonez, (2013, October 2). Meeting to Discuss Orbital Safety. (L. Cheney, Interviewer) EWR Range User Handbook. (1999). USA: Eastern and Western Range, USAF. Federal Communications Commission. (2013, March 15). Public Notice: Guidance on Obtaining Licenses for Small Satellites. Washington, D.C., United States of America: Federal Communications Commission. Retrieved from Green Propellant Rockets, n.d. (n.d.). Retrieved 2013, from Alta-Space.com: Humphries, M. (2011, November 19). Chinese Hackers Took Control of NASA Satellite for 11 Minutes. Retrieved from Geek.com: Hydrazine MSDS. (2013, March 21). Houston, Texas: Sciencelab.com, Inc. International Space Station. (2013, December 7). Retrieved from Wikipedia: 177

202 ion Electrospray Propulsion System for CubeSats (ieps). (2013, December 7). Retrieved from Space Propulsion Laboratory, Massachussets Institute of Technology: Keidar, M., J. Schein, K. Wilson, A. Garnhan, M. Au, B. Tang, L. Idzkowski, M. Krishnan, I. Beilis (2005). Magnetically Enhanced Vacuum Arc Thruster. Institute of Physics Publishing. Retrieved from iopscience.iop.org/ /14/4/004 Larangot, B., V. Conédéra, P. Dubreuil, T. Do Conto, & C. Rossi (n.d.). Solid Propellant MicroThruster: An Alternative Propulsion Device for Nanosatellite. Toulouse, France: LAAS-CNRS. Material Safety Data Sheet Gallium. (2010, January). Retrieved from Rotometals, Inc.: Material Safety Data Sheet R-134A. (2008, December). Bridgeton, New Jersey: National Refrigerants, Inc. Material Safety Data Sheet: 1-ethyl-3-methylimidazolium tetrafluoroborate. (2012, July 13). Saint Louis, MO: Sigma-Aldrich. Material Safety Data Sheet: Xenon. (2013, July 8). Radnor, PA: Airgas. Miket. (2013, January 16). How Dangerous Are the "Green Propellants"? Retrieved from Edotek: NASA/SP (2011, November). NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts for Implimentation, 1.0. Washington, D.C.: National Aeronautics and Space Administration. NASA-STD A: Process for Limiting Orbital Debris. (2012). Washington, DC: NASA. Opiela, J. N., E. Hillary, D. O. Whitlock, & M. Hennigan (2012). Debris Assessment Software User's Guide Version 2.0. Houston, TX: National Aeronautics and Space Administration. Orbital Data Request. (2013, 10 15). Retrieved from Space-Track: 178

203 Orbital Debris ORSAT. (2009, August 24). Retrieved from NASA Orbital Debris Program Office: Paganini, P. (2012, February 6). Hacking Satellite Communications. Retrieved from Infosec Island: Communications.html Pahl, R. A. (2010). Integration and Test of a Refrigerant-Based Cold-Gas Propulsion System for Small Satellites. Rolla: Missouri University of Science and Technology. PPTCUP - Pulsed Plasma Thruster for CubeSats (Pamphlet). (2012). Mars Scienc, LTD. Quinonez, E. (2013, November 23). Correspondence. (L. Cheney, Interviewer) Schein, J., A. Gernhan, F. Rysanek, & M. Krishnan (n.d.). Vacuum Arc Thruster for CubeSat Propulsion. Alameda Applied Sciences Corporation & University of Illinois, San Leandro, CA, & Urbana-Champaign, IL. Retrieved from Sutton, G. P., & O. Biblarz (2010). Rocket Propulsion Elements (Eith Edition ed.). Hoboken, New Jersey: John Wiley & Sons. Vacco (n.d.). Propulsion Unit for CubeSats. South El Monte, CA: Vacco industries. 179

204 APPENDIX A. Nomenclature 1U 3U ADCS AF AFSPC AFSPCI AFSPCMAN CA CDS COLA COPV EMI EOL FAA FCC GEO H 2 O 2 Independent Inhibit Inhibit I sp 1U-sized Standard CubeSat (approximately 10 x 10 x 10 cm cube and 1.33 kg) 3U-sized Standard CubeSat (approximately 10 x 10 x 30 cm cube and 4 kg) Attitude Determination and Control System Air Force Air Force Space Command Air Force Space Command Instruction Air Force Space Command Manual Conjunction Assessment CubeSat Design Specification, available at Collision Avoidance Composite Overwrapped Pressure Vessel Electromagnetic Interference End-of-Life (End of Mission) Federal Aviation Administration Federal Communications Commission Geosynchronous Orbit Hydrogen Peroxide An inhibit that functions in series, not parallel, with another inhibit where the two inhibits are not controlled by the same controller. For any two independent inhibits, there cannot be a single-point-offailure. A device that interrupts potential for a hazard to occur. Specific Impulse 180

205 ISS International Space Station JFCC SPACE Joint Functional Component Command for Space JSpOC Joint Space Operations Center LBB Leak-before-burst failure mode. LEO Low Earth Orbit MEMS Microelectromechanical Systems MSDS Material Safety Data Sheet N 2 Diatomic Nitrogen N 2 H 4 Hydrazine NASA National Aeronautics and Space Administration NDE Nondestructive Examination NTIA National Telecommunications and Information Administration ODAR Orbital Debris Assessment Report P-POD Poly Picosatellite Orbital Deployer PPT Pulsed Plasma Thruster RFID Radio-Frequency Identification SCAPE suit Self Contained Atmospheric Protective Ensemble (for handling hazardous materials) 181

206 SDS Safety Data Sheet swim lanes Tiered categories of requirements. The requirements specified for each swim lane is appropriate to the severity of the potential hazards that exist. TLE TOF VAFB V Two Line Element Time of Flight Vandenberg Air Force Base, California Change in Velocity 182

207 APPENDIX B. Draft of Standards Disclaimer At this time, any standards or requirements that are proposed in this document are in draft form and should not be used for mission planning purposes without consultation with the launch provider or the auxiliary payload integrator. The author hopes that the reader will find the discussions contained in this document useful as he or she assess the risks associated with their particular mission. For updates regarding the release of standards and requirements related to the CubeSat Design Specification (CDS), visit the Cal Poly CubeSat Program s website, 1. Fault tolerance and inhibits 1.1. Any potential hazard that is contained with dual-fault tolerance using at least three independent inhibits shall be identified as non-credible. Potential hazards that are deterministically shown to be infeasible shall also be identified as non-credible. All other potential hazards shall be identified as credible When the mission can be accomplished without imposing a hazard, the hazard shall be avoided. The CubeSat provider shall be prepared to defend the existence of any hazard that cannot be eliminated. The rationale shall match the gravity of the potential hazard The severity of each credible hazard shall be assessed as either negligible, marginal, critical, or catastrophic, according to the potential consequences, as defined in AFSPCMAN Vol. 1 Figure All catastrophic hazards shall be contained with dual-fault tolerance using at least three independent inhibits All critical hazards shall be contained with single-fault tolerance using at least two independent inhibits All marginal and all negligible hazards shall be contained with at least one inhibit No structural failure, given an adequate design margin, shall be regarded as a single point of failure. 2. Propulsion System General Requirements. The CubeSat provider shall provide a Propulsion System Summary Sheet (PSSS) to the launch integrator and the launch provider. The PSSS shall include a schematic and a description of the system performance limits, the propellant and its containment system, hazards, inhibits, and inhibit controls. The CubeSat provider shall follow the format given below. 183

208 184

209 185